WO2018137302A1 - 一种添加银行卡的方法及装置 - Google Patents

一种添加银行卡的方法及装置 Download PDF

Info

Publication number
WO2018137302A1
WO2018137302A1 PCT/CN2017/086689 CN2017086689W WO2018137302A1 WO 2018137302 A1 WO2018137302 A1 WO 2018137302A1 CN 2017086689 W CN2017086689 W CN 2017086689W WO 2018137302 A1 WO2018137302 A1 WO 2018137302A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
bank card
data
server
request
Prior art date
Application number
PCT/CN2017/086689
Other languages
English (en)
French (fr)
Inventor
李国庆
梅敬青
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to US16/480,865 priority Critical patent/US11017373B2/en
Priority to EP17893991.4A priority patent/EP3564886A4/en
Priority to CN201780009311.6A priority patent/CN108604345B/zh
Publication of WO2018137302A1 publication Critical patent/WO2018137302A1/zh
Priority to US17/236,473 priority patent/US11748737B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/326—Payment applications installed on the mobile devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3221—Access to banking information through M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/04—Payment circuits
    • G06Q20/06—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme
    • G06Q20/065—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme using e-cash
    • G06Q20/0658—Private payment circuits, e.g. involving electronic currency used among participants of a common payment scheme using e-cash e-cash managed locally
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3223—Realising banking transactions through M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3226—Use of secure elements separate from M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3227—Aspects of commerce using mobile devices [M-devices] using secure elements embedded in M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3229—Use of the SIM of a M-device as secure element
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/326—Payment applications installed on the mobile devices
    • G06Q20/3263—Payment applications installed on the mobile devices characterised by activation or deactivation of payment capabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G06Q20/363—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes with the personal data of a user
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G06Q20/367—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes
    • G06Q20/3672—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes initialising or reloading thereof

Definitions

  • the embodiments of the present invention relate to the field of terminals, and in particular, to a method and an apparatus for adding a bank card.
  • Payment applications such as Apple Pay, Samsung Pay, Huawei Pay, and Mi Pay are terminal-based embedding developed by the terminal manufacturer, the card organization, and the issuer.
  • Payment device for Embedded Secure Element (eSE) and Near Field Communication (NFC) communication interface allowing users to bind their own bank card such as credit card or debit card to the terminal to form a virtual Bank card, in which the card organization can be China UnionPay; the card issuer can be a state-owned bank such as Bank of China, and a commercial bank such as China Merchants Bank.
  • the card reader of the NFC Point of Sale (POS) machine can be used for the terminal, and this action is also called “Tap”, and the card payment can be completed.
  • POS Point of Sale
  • the virtual bank card data including the payment token (Token) and the payment key, are stored in the eSE, and the eSE has a secure storage capacity not lower than the physical bank card, and is a reliable virtual bank card carrier. Binding a physical bank card to a virtual bank card generated in the terminal is also called a device card.
  • FIG. 1 a schematic diagram of a process of binding a physical bank card to a terminal to generate a virtual bank card.
  • the process of binding the physical bank card to the terminal to generate the virtual bank card is equivalent to a traditional online payment, and it is necessary to verify the bank card account information or the withdrawal password, and send a short message by reserving the mobile phone number to the cardholder.
  • the way of verification code verifies the identity of the cardholder, which is required for the security of bank card transactions.
  • each terminal's payment application may have multiple debit or credit cards, and may bind multiple cards in their own payment application to obtain discounts from different banks.
  • the smart phone may be updated, or after the terminal is repaired and the factory settings are restored after the repair, the physical bank card needs to be re-bound to the terminal.
  • the terminal payment application designed by the terminal manufacturer does not save the bank card account information, and the virtual bank card data saved in the eSE is not allowed to be copied. Therefore, adding the physical bank card to the new terminal can only input the bank card account information and In the manner of performing cardholder verification, the user can only re-bind the physical bank card to the new terminal or the terminal returned after the repair one by one. The information input process is very cumbersome and the user experience is poor.
  • the embodiment of the invention provides a method and a device for adding a bank card, which can effectively improve the user experience.
  • the embodiment of the present invention provides the following technical solutions:
  • a first aspect of the embodiments of the present invention provides a method for adding a bank card to a first terminal having a protected operating environment, the method comprising: first, receiving, by the first terminal, a request for adding a bank card; and then, a terminal establishes a point-to-point wireless communication connection with the second terminal, and sends a request for acquiring bank card data to the second terminal; after receiving the bank card data sent by the second terminal, the first terminal acquires the bank card account information according to the bank card data; The first terminal further sends a card opening request to the first server, thereby adding a bank card in the first terminal, wherein the card opening request includes the bank card account information.
  • the first terminal in the embodiment of the present application obtains backup data of the relevant bank card account information from the second terminal by using a point-to-point wireless communication connection with the second terminal, and binds the physical bank card to the first terminal to generate a virtual bank by using the backup data.
  • the card does not require the user to input the bank card account information in a non-automatic manner (photographing, NFC reading or manual input) in the first terminal, thereby simplifying the user operation steps and effectively improving the user experience.
  • the protected operating environment is a Trusted Execution Environment (TEE) or a Secure Element (SE).
  • the SE has three forms of existence: an eSE existing on a separate chip fixed on the terminal motherboard, or integrated in a Subscriber Identification Module (SIM) card, accessed through the SIM card slot and connected to the terminal.
  • SIM Subscriber Identification Module
  • SIM SE or integrated in a micro (Secure Digital Memory Card, SD) card, accessed through an SD card slot and connected to the terminal via a Universal Serial Bus (USB) interface SD SE.
  • SD Secure Digital Memory Card
  • USB Universal Serial Bus
  • the first terminal after the first terminal receives the request for adding the bank card, the first terminal establishes the second terminal with the second terminal.
  • the method further includes: displaying at least a first option and a second option on the display screen of the first terminal, wherein the first option is inputting a bank card number or scanning a bank card or a card reading number, the second option To obtain bank card data from other terminals.
  • the method further includes: displaying the identifier of the at least one other terminal under the second option; or After the first terminal receives the user's selection of the second option, the identifier of the at least one other terminal is displayed; wherein the other terminal includes the second terminal, and the other terminal logs in with the same account as the first terminal.
  • the first terminal sends a request for acquiring the bank card data to the second terminal
  • the method includes: the first terminal sends the verification credential to the second terminal by using the point-to-point wireless communication connection. And/or a first terminal certificate; wherein the verification credential includes a service credential and a credential credential, the first terminal credential is a terminal credential preset in the TEE of the first terminal, and the service credential is used to prove that the first terminal obtains the bank card data The service is legal, and the identity credential is used to prove that the account that is logged in in the first terminal is legal.
  • the first terminal acquires the bank card data by transmitting the verification credential and/or the first terminal certificate to the second terminal, thereby improving the security of acquiring the bank card data.
  • the first terminal receives the bank card data sent by the second terminal, where the method includes: receiving, by the first terminal, the first encrypted data sent by the second terminal, where The encrypted data includes the first encrypted bank card data encrypted by the private key of the second terminal and the public key of the first terminal, the identifier of the image processing algorithm, and the parameters used by the image processing algorithm, and the number of the first encrypted bank card
  • the bank card account information image includes bank card account information
  • the bank card account information is used to identify the bank card
  • the first terminal receives the second encrypted data sent by the second terminal, wherein the second encryption
  • the data includes migration data encrypted by the private key of the second terminal and the public key of the first terminal, and the migration data includes the last four digits of the PAN and the Bank Identification Number (BIN).
  • the embodiment of the present application provides a specific implementation manner of the obtained bank card data, and the bank card data provided by the second terminal to the first terminal includes the first The encrypted data or the second encrypted data is caused to enable the first terminal to open the card according to the bank card data.
  • the first terminal acquires the bank card account information according to the bank card data in the protected operating environment, thereby improving the first terminal acquiring the bank card account information. safety.
  • the acquiring, by the first terminal, the bank card account information according to the bank card data includes: the first terminal verifying the privateness of the second terminal by using the public key of the second terminal in the TEE Key signature, and decrypting the first encrypted data by using the private key of the first terminal, obtaining the first encrypted bank card data, the identifier of the image processing algorithm, and the parameters used by the image processing algorithm; the first terminal is in the TEE according to the image processing algorithm Identifying parameters used by the corresponding image processing algorithm and the image processing algorithm, decrypting the first encrypted bank card data, and obtaining a bank card account information image; the first terminal processing the bank card by using an Optical Character Recognition (OCR) algorithm in the TEE Account information image, get bank card account information.
  • OCR Optical Character Recognition
  • the acquiring, by the first terminal, the bank card account information according to the bank card data includes: the first terminal verifying the privateness of the second terminal by using the public key of the second terminal in the TEE Key signature, and decrypting the second encrypted data by using the private key of the first terminal to obtain the migrated data; the first terminal sends the first terminal certificate, the migration data, and the signature of the second terminal to the migrated data to the first server; Bank card account information sent by the first server.
  • the bank card data transmitted by the first terminal and the second terminal is encrypted and decrypted by the public key and the private key, and the bank card account information is obtained, thereby effectively improving the security of obtaining the bank card data.
  • the method further includes: the first terminal acquiring the service credential from the first server, where the service credential includes The service serial number and the signature of the first server to the service serial number; the first terminal saves the business credentials in the TEE.
  • the embodiment of the invention provides a specific implementation manner for obtaining a service credential, thereby effectively improving the security of obtaining bank card data.
  • the method further includes: the first terminal sends the service serial number to the second server by using the same account as the second terminal; and the first terminal receives the identity sent by the second server
  • the credential includes the service serial number and the signature of the second server to the service serial number; the first terminal saves the identity credential in the TEE.
  • the first terminal sends a first logout message to the first server, where the first logoff message is used to instruct the first server to log off the service credential; or/and, the first The terminal sends a second logout message to the second server, where the second logoff message is used to indicate that the second server is logged off. Credentials.
  • the first terminal sends a request to cancel the service credential to the first server, and sends a request to log off the identity credential to the second server to log off the two credentials to prevent the replay attack.
  • a second aspect of the embodiments of the present invention provides a method for adding a bank card to a second terminal having a protected operating environment, including: establishing, by the second terminal, a point-to-point wireless communication connection with the first terminal; The terminal receives the request for acquiring the bank card data sent by the first terminal; the second terminal sends the bank card data to the first terminal.
  • the first terminal in the embodiment of the present application provides a point-to-point wireless communication connection with the second terminal, and the second terminal provides the first terminal with backup data of the relevant bank card account information, so that the first terminal binds the physical bank card by using the backup data.
  • the virtual bank card is generated to the first terminal, and the user does not need to input the bank card account information in the non-automatic manner (photographing, NFC reading or manual input) in the first terminal, thereby simplifying the user operation steps and effectively improving the user experience. .
  • the second terminal includes a TEE and an SE
  • the method further includes: receiving, by the second terminal, the adding The bank card requests the second terminal to obtain the bank card account information image according to the request for adding the bank card; the second terminal performs image encryption processing on the bank card account information image according to the image processing algorithm to obtain the first encrypted bank card data; the second terminal The first encrypted bank card data is encrypted by using the public key of the second terminal to obtain the second encrypted bank card data; the second terminal sets an access password for the second encrypted bank card data to obtain the first backup data; the second terminal A backup data is stored in the TEE, and the identifier of the image processing algorithm and the parameters used by the image processing algorithm are saved in the eSE.
  • the second terminal encrypts the bank card account information image by using three layers of encryption
  • the first backup data is saved in the TEE, and the identifier of the image processing algorithm and the parameters used by the image processing algorithm are saved in the eSE, thereby improving the storage of the backup data. safety.
  • the second terminal includes a TEE
  • the method further includes: receiving, by the second terminal, the added bank card
  • the second terminal obtains the migration data according to the request for adding the bank card, and the migration data includes the last four digits of the PAN and the BIN;
  • the second terminal encrypts the migration data according to the public key of the second terminal to obtain the second backup data;
  • the second terminal will The second backup data is stored in the TEE;
  • the second terminal sends a cache request to the first server, where the cache request includes the last four digits of the PAN and the second terminal certificate, and the cache request is used to request the first server to associate the bank card with the last four digits of the PAN.
  • the account information is associated with the second terminal certificate. Therefore, after encrypting the last four digits of the PAN and the BIN, the second terminal saves the second backup data to the TEE, thereby improving the security of saving the backup data. Moreover, the first server pre-stores the bank card account information related to the last four digits of the PAN, and further improves the security of the first terminal acquiring the bank card account information related to the last four digits of the PAN.
  • the receiving, by the first terminal, the request for acquiring the bank card data includes: receiving the verification credential sent by the first terminal and the first terminal certificate, where the verification credential includes The service credential and the identity credential, the first terminal certificate is a terminal certificate preset in the TEE of the first terminal, the service credential is used to prove that the first terminal obtains the bank card data, and the identity credential is used to prove the login in the first terminal.
  • the account number is legal.
  • the method further includes: the second terminal verifying the service credential, the identity credential, and the a terminal certificate; if the second terminal verifies that the service credential, the identity credential, and the first terminal certificate are successful, the second terminal generates the first encrypted data, where the first encrypted data includes the private key signature and the first The first encrypted bank card data of the terminal's public key encryption, the identifier of the image processing algorithm, and the parameters used by the image processing algorithm, the first encrypted bank card data includes a bank card account information image, and the bank card account information image includes bank card account information, The bank card account information is used to identify the bank card; or the second terminal generates the second encrypted data, and the second encrypted data includes the migration data encrypted by the private key of the second terminal and the public key of the first terminal, and the migration data includes the PAN.
  • the last four digits and BIN The last four digits and BIN.
  • the bank card data transmitted by the first terminal and the second terminal is encrypted and decrypted by the public key and the private key, and the bank card account information is obtained, thereby effectively improving the security of obtaining the bank card data.
  • the second terminal is configured to verify the service credential, the identity credential, and the first terminal credential, and specifically includes: acquiring, by the second terminal, the first server certificate and the second server certificate; The second terminal verifies the service credential according to the first server certificate, and verifies the identity credential according to the second server certificate; the second terminal verifies the first terminal certificate by using the certificate authority root certificate.
  • the embodiment of the invention provides a specific implementation manner for verifying the service credential, the identity credential and the first terminal certificate, thereby effectively improving the security of obtaining the bank card data.
  • the second terminal sends the bank card data to the first terminal, where the bank card data includes the first encrypted data or the second encrypted data.
  • the embodiment of the invention provides a specific implementation manner of bank card data.
  • the second terminal sends the bank card to the first terminal.
  • the method further includes: the second terminal sending the first terminal certificate to the first server, so that the first server associates the first terminal certificate with the bank card account information.
  • the first server may check the identity of the first terminal by using the first terminal certificate provided by the second terminal, that is, the request for obtaining the bank card account information. Whether the certificate of the terminal is consistent with the certificate sent by the second terminal.
  • a third aspect of the embodiments of the present invention provides a first terminal, a specific protected operating environment in the first terminal, where the protected operating environment is a trusted execution environment TEE or a security unit SE, and includes: a receiving unit, configured to: Receiving a request for adding a bank card; a connection unit, configured to establish a point-to-point wireless communication connection with the second terminal; a sending unit, configured to send a request for acquiring bank card data to the second terminal; and a receiving unit, configured to receive the second terminal
  • the bank card data is sent;
  • the processing unit is configured to obtain the bank card account information according to the bank card data;
  • the sending unit is further configured to send the card opening request to the first server, thereby adding the bank card in the first terminal, and the card opening request includes Bank card account information.
  • a fourth aspect of the present invention provides a second terminal, which is applied to a second terminal having a protected operating environment, and includes: a connecting unit, configured to establish a point-to-point wireless communication connection with the first terminal; and a receiving unit And a request for receiving the bank card data sent by the first terminal, and a sending unit, configured to send the bank card data to the first terminal.
  • the foregoing third and fourth functional modules may be implemented by hardware, or may be implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • a transceiver for performing functions of a receiving unit and a transmitting unit, a processor for performing functions of the processing unit, a memory, and a program instruction for the processor to process the method of adding a bank card in the embodiment of the present application.
  • the processor, transceiver, and memory are connected by a bus and communicate with each other. Specifically, you can The function of the behavior of the first terminal in the method of adding a bank card provided by the first aspect, and the function of the behavior of the second terminal in the method of adding a bank card provided by the second aspect.
  • an embodiment of the present application provides a first terminal, including: a processor, a memory, a bus, and a communication interface; the memory is configured to store a computer execution instruction, and the processor is connected to the memory through the bus, when the When a terminal is running, the processor executes the computer-executed instructions stored in the memory to cause the first terminal to perform the method of any of the above aspects.
  • the embodiment of the present application provides a second terminal, including: a processor, a memory, a bus, and a communication interface; the memory is configured to store a computer execution instruction, and the processor is connected to the memory through the bus, when the When the two terminals are running, the processor executes the computer-executed instructions stored in the memory to cause the second terminal to perform the method of any of the above aspects.
  • the embodiment of the present application provides a computer readable storage medium, configured to store computer software instructions used by the first terminal, and when executed on a computer, enable the computer to perform the method of any of the foregoing aspects. .
  • the embodiment of the present application provides a computer readable storage medium, configured to store computer software instructions used by the second terminal, and when executed on a computer, enable the computer to perform the method of any of the foregoing aspects. .
  • an embodiment of the present application provides a computer program product comprising instructions that, when run on a computer, cause the computer to perform the method of any of the above aspects.
  • the names of the first terminal, the second terminal, the first server, and the second server are not limited to the device itself. In actual implementation, the devices may appear under other names. As long as the functions of the respective devices are similar to the embodiments of the present application, they are within the scope of the claims and their equivalents.
  • FIG. 1 is a schematic diagram of a process of binding a physical bank card provided by the prior art to a terminal to generate a virtual bank card;
  • FIG. 2 is a simplified schematic diagram of a system architecture according to an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a server according to an embodiment of the present disclosure.
  • FIG. 4 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for adding a bank card according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of an interface display of a first terminal according to an embodiment of the present disclosure.
  • FIG. 7 is a flowchart of a method for adding a bank card according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of an interface display of a first terminal according to an embodiment of the present disclosure.
  • FIG. 9 is a flowchart of a method for adding a bank card according to an embodiment of the present invention.
  • FIG. 10 is a flowchart of a method for adding a bank card according to an embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of a first terminal according to an embodiment of the present disclosure.
  • FIG. 12 is a schematic structural diagram of a first terminal according to an embodiment of the present disclosure.
  • FIG. 13 is a schematic structural diagram of a second terminal according to an embodiment of the present disclosure.
  • FIG. 14 is a schematic structural diagram of a second terminal according to an embodiment of the present invention.
  • the embodiment of the invention provides a method for adding a bank card.
  • the bank card can be a credit card or a debit card.
  • the basic principle is that most terminals with NFC payment function support protection. Operating environment, such as TEE and / or eSE.
  • the first terminal When the user needs to bind the physical bank card to the first terminal to generate the virtual bank card, the first terminal preferably establishes a point-to-point wireless communication connection with the second terminal (for example, a Bluetooth (BT) connection, or an NFC point-to-point connection.
  • BT Bluetooth
  • the second terminal verifies the identity of the first terminal, sends the backup data to the first terminal, first
  • the terminal obtains the bank card account information in the protected operating environment according to the obtained backup data, and then uses the obtained bank card account information to generate a card opening request, and finally successfully opens the virtual bank returned by the first server on the first terminal.
  • the card is installed in the eSE of the first terminal. It should be noted that after the user binds the physical bank card to the second terminal to generate the virtual bank card on the second terminal for the first time, after the user permits and/or authenticates, the backup data is generated in the second terminal, and the second terminal is utilized.
  • the backup hardware is saved by the security hardware in the protected operating environment (for example, TEE's trusted storage space, or eSE storage space). Therefore, the first terminal in the embodiment of the present application obtains backup data of the relevant bank card account information from the second terminal by using a point-to-point wireless communication connection with the second terminal, and binds the physical bank card to the first terminal by using the backup data.
  • Virtual bank card without the user entering the bank card account information (PAN and expiration date, CVV, etc.) in a non-automated manner (photographing, NFC reading or manual input) at the first terminal, possibly including the mobile phone number reserved by the bank card to the bank Etc.) Open the card, simplifying the user's operation steps and effectively improving the user experience.
  • the system architecture may include a first terminal 11, a second terminal 12, a first server 13, a second server 14, and a wireless communication network 15.
  • the first terminal 11 and the second terminal 12 are devices that provide voice and/or data connectivity to the user.
  • mobile phones tablets, laptops, ultra-mobile personal computers (UMPCs), netbooks, personal digital assistants (PDAs), and the like.
  • UMPCs ultra-mobile personal computers
  • PDAs personal digital assistants
  • the first terminal 11 and the second terminal 12 included in the system architecture of the present invention are mobile phones.
  • the first terminal and the second terminal communicate with the first server and the second server by wireless communication technology.
  • the second terminal and the first terminal can communicate via a point-to-point wireless communication connection.
  • the first server 13 is a Token Service Provider (TSP), which is generally implemented by a UnionPay or Visa, Mastercard, or the like, and may also be implemented and provided by a card issuer such as a bank; in the system, the receiving terminal sends the The card opening request is a token service request, and sends the virtual bank card data to the terminal, including the token (ie, the virtual card number of the virtual bank card installed in the eSE in the embodiment of the present application) and token related data, such as a card key. Etc., the card key is used to prove that the card is legal to the transaction acceptance terminal (eg, PoS machine); in addition, the TSP also provides the service serial number and business credentials;
  • TSP Token Service Provider
  • the second server 14 refers to a server corresponding to the payment application, such as a server corresponding to the wallet service provided by each major mobile phone manufacturer, and may also be a cloud server provided by each major mobile phone manufacturer (the provided cloud service includes a wallet service); the user is on the terminal.
  • the second server can be used to manage the status of the payment application (ie, the wallet), such as locking the wallet, erasing the wallet data, etc.;
  • the second server may also provide the terminal with the identity credential, and prove that the wallet application successfully logs in to the account verified by the server.
  • the wireless communication network 15 is a network that provides wireless communication functions.
  • Wireless communication networks may employ different communication technologies, such as code division multiple access (CDMA), wideband code division multiple access (WCDMA), and time division multiple access (TDMA).
  • Code division multiple access CDMA
  • WCDMA wideband code division multiple access
  • TDMA time division multiple access
  • Frequency division multiple access (FDMA) orthogonal frequency-division multiple access
  • OFDMA orthogonal frequency-division multiple access
  • SC-FDMA single carrier frequency division multiple access
  • carrier sensing Carrier sense multiple access with collision avoidance According to the capacity, rate, delay and other factors of different networks, the network can be divided into 2G (generation) network, 3G network or 4G network.
  • a typical 2G network includes a global system for mobile communications/general packet radio service (GSM) network or a general packet radio service (GPRS) network.
  • GSM global system for mobile communications/general packet radio service
  • GPRS general packet radio service
  • a typical 3G network includes a universal mobile communication system (universal mobile communication system).
  • a typical 4G network includes a long term evolution (LTE) network.
  • the UMTS network may also be referred to as a universal terrestrial radio access network (UTRAN).
  • the LTE network may also be referred to as an evolved universal terrestrial radio access network (E-).
  • E- evolved universal terrestrial radio access network
  • UTRAN Universal Terrestriality
  • it can be divided into a cellular communication network and a wireless local area network (WLAN), wherein the cellular communication network is dominated by scheduling, and the WLAN is dominant.
  • WLAN wireless local area network
  • the aforementioned 2G, 3G and 4G networks are all cellular communication networks.
  • the embodiments of the present invention are equally applicable to other wireless communication networks, such as 4.5G or 5G networks, or other non-cellular communication networks.
  • the embodiment of the present invention sometimes abbreviates the wireless communication network into a network.
  • FIG. 3 is a schematic diagram of a composition of a server according to an embodiment of the present invention.
  • the first server 13 and the second server 14 in FIG. 2 may be implemented in the manner of the server in FIG. 3.
  • the server may include at least one processor 21, a memory 22, a communication interface 23, and a communication bus 24.
  • the processor 21 is a control center of the server, and may be a processor or a collective name of a plurality of processing elements.
  • the processor 21 is a central processing unit (CPU), may be an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • microprocessors Digital Signal Processors, DSPs
  • FPGAs Field Programmable Gate Arrays
  • the processor 21 can perform various functions of the server by running or executing a software program stored in the memory 22 and calling data stored in the memory 22.
  • processor 21 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG.
  • the server may include multiple processors, such as processor 21 and processor 25 shown in FIG.
  • processors can be a single core processor (single-CPU), can also be a multi-core processor (multi-CPU).
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data, such as computer program instructions.
  • the memory 22 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type that can store information and instructions.
  • the dynamic storage device can also be an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Compact Disc Read-Only Memory (CD-ROM) or other optical disc storage, and a disc storage device. (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be Any other media accessed, but not limited to this.
  • Memory 22 may be present independently and coupled to processor 21 via communication bus 24.
  • the memory 22 can also be integrated with the processor 21.
  • the memory 22 is used to store a software program that executes the solution of the present invention and is controlled by the processor 21.
  • the communication interface 23 uses a device such as any transceiver for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), Wireless Local Area Networks (WLAN), etc. .
  • the communication interface 23 may include a receiving unit that implements a receiving function, and a transmitting unit that implements a transmitting function.
  • the communication bus 24 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus.
  • ISA Industry Standard Architecture
  • PCI Peripheral Component
  • EISA Extended Industry Standard Architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 3, but it does not mean that there is only one bus or one type of bus.
  • the device structure shown in FIG. 3 does not constitute a limitation to the server, and may include more or less components than those illustrated, or some components may be combined, or different component arrangements.
  • FIG. 4 is a schematic diagram of a composition of a terminal according to an embodiment of the present invention.
  • the first terminal 11 and the second terminal 12 in FIG. 2 may be implemented in the manner of the terminal in FIG. 4.
  • the terminal may include at least one processor 31, memory 32, display 33, and transceiver 34.
  • the processor 31 is a control center of the terminal, and may be a processor or a collective name of a plurality of processing elements.
  • processor 31 is a CPU, which may be an ASIC, or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more DSPs, or one or more FPGAs.
  • the processor 31 can perform various functions of the terminal by running or executing a software program stored in the memory 32 and calling data stored in the memory 32.
  • the processor 31 described in the embodiment of the present application operates in a TEE environment.
  • processor 31 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG.
  • the terminal may include multiple processors, such as processor 31 and processor 35 shown in FIG.
  • processors can be a single-CPU processor. It can also be a multi-CPU processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data, such as computer program instructions.
  • Memory 32 may be a ROM or other type of static storage device that may store static information and instructions, RAM or other types of dynamic storage devices that may store information and instructions, or may be EEPROM, CD-ROM or other optical disk storage, optical disk storage. (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be Any other media accessed, but not limited to this.
  • Memory 32 may be present independently and coupled to processor 31 via communication bus 34.
  • the memory 32 can also be integrated with the processor 31.
  • the memory 32 is used to store a software program that executes the solution of the present invention, and is controlled by the processor 31 for execution.
  • the memory 32 described in the embodiment of the present application is a memory in a TEE environment.
  • the display 33 can be used to display information input by the user or information provided to the user as well as various menus of the terminal.
  • the display 33 may include a display screen 331.
  • the display screen 331 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.
  • Transceiver 34 using any type of transceiver, is used to communicate with other devices or communication networks, such as Ethernet, RAN, WLAN, and the like.
  • the transceiver 34 may include a receiving unit to implement a receiving function, and a transmitting unit to implement a transmitting function.
  • the device structure shown in FIG. 4 does not constitute a limitation to the terminal, and may include more or less components than those illustrated, or a combination of certain components, or different component arrangements.
  • the terminal may further include a battery, a camera, a Bluetooth module, a Global Positioning System (GPS) module, an NFC module, an SE module, and the like, and details are not described herein.
  • GPS Global Positioning System
  • each module for the first terminal, the specific functions of each module are as follows:
  • the transceiver 34 is configured to receive a request for adding a bank card.
  • the display 33 is configured to display at least a first option and a second option on the display screen of the first terminal, where the first option is to input a bank card number or scan a bank card or a card reading number, and the second option is to obtain from another terminal. Bank card data.
  • the display 33 is further configured to display the identifier of the at least one other terminal under the second option; or, after the first terminal receives the user's selection of the second option, display the identifier of the at least one other terminal; wherein the other terminal includes the The second terminal, the other terminal and the first terminal use the same account (the same payment application account, or the same cloud service account) to log in.
  • the processor 31 is configured to establish a point-to-point wireless communication connection with the second terminal, the transceiver 34 is further configured to send a request for acquiring the bank card data to the second terminal, and the transceiver 34 is further configured to receive the bank sent by the second terminal.
  • Card data the processor 31 is configured to obtain bank card account information according to the bank card data in the protected operating environment, the protected operating environment may be a TEE or an SE; the transceiver 34 is further configured to send the card to the first server.
  • the transceiver 34 is configured to send the verification credential and/or the first terminal certificate to the second terminal by using the point-to-point wireless communication connection; wherein the verification credential includes the service credential and the identity credential, and the first terminal credential is preset in the first terminal
  • the verification credential includes the service credential and the identity credential
  • the first terminal credential is preset in the first terminal
  • the terminal certificate in the protected operating environment, the service credential is used to prove that the first terminal obtains the bank card data, and the identity credential is used to prove that the account registered in the first terminal is legal.
  • the transceiver 34 is specifically configured to receive first encrypted data sent by the second terminal, where the first encrypted data is The first encrypted bank card data encrypted by the private key signature of the second terminal and the public key of the first terminal, the identifier of the image processing algorithm, and the parameters used by the image processing algorithm, the first encrypted bank card data including the bank card account information image
  • the bank card account information image includes bank card account information, and the bank card account information is used to identify the bank card; or the first terminal receives the second encrypted data sent by the second terminal, where the second encrypted data includes the second terminal
  • the private key signature and the migration data of the first terminal's public key encryption, the migration data includes the last four digits of the PAN and the BIN.
  • the processor 31 is specifically configured to: in the TEE of the first terminal, verify the private key signature of the second terminal by using the public key of the second terminal, and decrypt the first encrypted data by using the private key of the first terminal to obtain the first An encryption bank card data, an identifier of the image processing algorithm, and a parameter used by the image processing algorithm; the first terminal in the TEE of the first terminal according to an image processing algorithm corresponding to the identifier of the image processing algorithm and a parameter used by the image processing algorithm, Decrypting the first encrypted bank card data to obtain a bank card account information image; the first terminal uses the OCR to identify the bank card account information image in the TEE of the first terminal, and obtains the bank card account information.
  • the processor 31 is specifically configured to: in the TEE of the first terminal, verify the private key signature of the second terminal by using the public key of the second terminal, and decrypt the second encrypted data by using the private key of the first terminal to obtain the migration.
  • Data the first terminal sends the first terminal certificate, the migration data, and the signature of the second terminal to the migration data to the first server; the first terminal receives the bank card account information sent by the first server.
  • the transceiver 34 is further configured to obtain, by the first terminal, the service credential from the first server, where the service credential includes a service serial number and a signature of the first server to the service serial number, and the memory 32 is configured to save the service credential in the TEE of the first terminal.
  • the transceiver 34 is further configured to send a service serial number to the second server by using the same account as the second terminal;
  • the transceiver 34 is further configured to receive the identity credential sent by the second server, where the identity credential includes a service serial number and a signature of the second server to the service serial number;
  • the memory 32 is further configured to save the identity credential in the TEE of the first terminal.
  • the transceiver 34 is further configured to send a first logout message to the first server, where the first logout message is used to instruct the first server to log off the service credential; or/and, send a second logout message to the second server, where the second logoff message is used Instructing the second server to log out of the identity credentials.
  • each module for the second terminal, the specific functions of each module are as follows:
  • the transceiver 34 is configured to receive a request for acquiring bank card data sent by the first terminal, and the transceiver 34 is further configured to send the bank card data to the first terminal.
  • the transceiver 34 is further configured to receive a request for adding a bank card; the processor 31 is further configured to obtain a bank card account information image according to the request for adding the bank card; the processor 31 is further configured to use the image processing algorithm to perform the bank card account information.
  • the image is subjected to image encryption processing to obtain the first encrypted bank card data; the processor 31 is further configured to encrypt the first encrypted bank card data by using the public key of the second terminal to obtain the second encrypted bank card data; the processor 31, And is further configured to set an access password for the second encrypted bank card data to obtain the first backup data; the memory 32 is configured to save the first backup data to the TEE of the second terminal, and use the identifier of the image processing algorithm and the image processing algorithm. The parameters are saved in eSE.
  • the transceiver 34 is further configured to receive a request for adding a bank card; the processor 31 is further configured to acquire the migration data according to the request for adding the bank card, where the migration data includes the last four digits of the PAN and the BIN; the processor 31 is further configured to be used according to the The public key of the second terminal encrypts the migration data to obtain the second backup data; the memory 32 is also used to count the second backup number.
  • the transceiver 34 is further configured to send a cache request to the first server, where the cache request includes the last four digits of the PAN and the second terminal certificate, and the cache request is used to request the first server to be followed by the PAN.
  • the related bank card account information is associated with the second terminal certificate.
  • FIG. 5 is a flowchart of a method for adding a bank card according to an embodiment of the present invention. The method is applied to a first terminal having a TEE. As shown in FIG. 5, the method specifically includes:
  • the first terminal receives a request to add a bank card.
  • the user turns on the NFC function of the first terminal, clicks "NFC" in the wireless and network setting interface to enter the control interface, enters the NFC control interface, opens the NFC function, and simultaneously opens the NFC built-in security chip function; then, the user is in the first Click the payment application icon on the main screen of a terminal, log in to the account of the payment application, enter the payment application user interface, click the “card package”, and the user enters the add card interface.
  • the card type option the user chooses to add a bank card (credit card or debit card), and the first terminal receives a request to add a bank card.
  • FIG. 6 is a schematic diagram of an interface display of a first terminal according to an embodiment of the present disclosure.
  • the first option and the second option are displayed on the display screen of the first terminal, and the user can select according to his own needs. If the user adds the bank card to the first terminal for the first time, the first option can be selected; if the user has previously added the bank card to other terminals, the user can select the second option to obtain the bank card data from the other terminal. Further, an identifier of at least one other terminal is displayed below the second option.
  • the first terminal displays the identifier of the at least one other terminal; wherein the other terminal includes the second terminal, and the other terminal uses the same payment application as the first terminal.
  • the first terminal may present the first option and the second option, and the input interface corresponding to the first option and the second option, by using a Trusted User Interface (TUI).
  • TTI Trusted User Interface
  • the first terminal establishes a point-to-point wireless communication connection with the second terminal.
  • the first terminal After the first terminal receives the request to add the bank card, and the user selects the option of adding the bank card through the other terminal, the first terminal establishes a point-to-point wireless communication connection with the second terminal.
  • the first terminal sends a request for acquiring bank card data to the second terminal.
  • the first terminal After the first terminal establishes a point-to-point wireless communication connection with the second terminal, the first terminal sends a request for acquiring the bank card data to the second terminal.
  • the first terminal may first obtain the verification credential and the first terminal certificate, and the verification credential may include the service credential and the identity credential.
  • the first terminal acquires a service credential from the first server, where the service credential includes a service serial number and a signature of the first server to the service serial number, and the service credential is used to prove that the first terminal obtains the bank card data business legally;
  • the terminal sends the service serial number to the second server by using the same account as the second terminal, and the first terminal receives the identity credential sent by the second server, where the identity credential includes the service serial number and the signature of the second server to the service serial number, and the identity credential is used for the proof.
  • the account that is logged in in the first terminal is legal.
  • the first terminal saves the identity credential in the TEE of the first terminal.
  • the first terminal saves the service credentials in the TEE of the first terminal.
  • First end The end certificate is a terminal certificate preset in the TEE of the first terminal.
  • the request to obtain bank card data includes verification credentials and/or first terminal credentials.
  • the second terminal receives a request for acquiring bank card data sent by the first terminal.
  • the second terminal After the first terminal sends the request for acquiring the bank card data to the second terminal, the second terminal receives the request for acquiring the bank card data sent by the first terminal.
  • the second terminal sends the bank card data to the first terminal.
  • the second terminal After the second terminal receives the request for acquiring the bank card data sent by the first terminal, the second terminal sends the bank card data to the first terminal.
  • the second terminal needs to verify the verification credential and/or the first terminal certificate. If the second terminal verifies the verification credential and/or the first terminal certificate is successful, the second terminal generates the first encrypted data or the second encrypted data, where the first encrypted data includes the private key signature of the second terminal and the public key of the first terminal.
  • the encrypted first encrypted bank card data, the identifier of the image processing algorithm, and the parameters used by the image processing algorithm, the first encrypted bank card data includes one or more bank card account information images selected by the user, and the bank card account information image includes Bank card account information, the bank card account information is used to identify the bank card;
  • the second encrypted data includes the migration data encrypted by the private key of the second terminal and the public key of the first terminal, and the migration data includes at least one bank card PAN The last four digits and BIN. BIN is used to identify banks.
  • the user interface may be provided to prompt the user to select one or more bank cards that have been bound on the second terminal for migration, and receive the user selection.
  • the bank card data is the first encrypted data or the second encrypted data.
  • the first terminal receives the bank card data sent by the second terminal.
  • the first terminal After the second terminal sends the bank card data to the first terminal, the first terminal receives the bank card data sent by the second terminal.
  • the first terminal acquires bank card account information according to the bank card data.
  • the first terminal After the first terminal receives the bank card data sent by the second terminal, in the case that the bank card data includes the first encrypted data, the first terminal uses the public key verification of the second terminal in the protected operating environment, such as in the TEE. Signing the private key of the second terminal, and decrypting the first encrypted data by using the private key of the first terminal, obtaining the first encrypted bank card data, the identifier of the image processing algorithm, and the parameter used by the image processing algorithm; the first terminal is at the first The TEE of the terminal decrypts the first encrypted bank card data according to the image processing algorithm corresponding to the identifier of the image processing algorithm and the parameters used by the image processing algorithm to obtain the bank card account information image, and the first terminal processes the bank card account information by using the OCR algorithm. Image, get bank card account information.
  • the first terminal After the first terminal receives the bank card data sent by the second terminal, in the case that the bank card data includes the second encrypted data, the first terminal verifies the privateness of the second terminal by using the public key of the second terminal in the protected operating environment. Key signature, and decrypting the second encrypted data by using the private key of the first terminal to obtain the migrated data; the first terminal sends the first terminal certificate, the migration data, and the signature of the second terminal to the migrated data to the first server; Bank card account information sent by the first server.
  • the first terminal sends a card opening request to the first server, so that a bank card is added to the first terminal.
  • the first terminal After the first terminal acquires the bank card account information according to the bank card data, the first terminal sends a card opening request to the first server, so that the bank card is added in the first terminal, and the card opening request includes the bank card account information.
  • the first terminal in the embodiment of the present application is connected to the second terminal by point-to-point wireless communication.
  • the second terminal acquires the bank card data of the relevant bank card account information, and binds the physical bank card to the first terminal to generate the virtual bank card by using the bank card data, without the user inputting the bank card account information in the non-automatic manner in the first terminal.
  • the card simplifies the user's operation steps and effectively improves the user experience.
  • FIG. 7 is a flowchart of a method for adding a bank card according to an embodiment of the present invention, which refines the case where the bank card data shown in FIG. 5 includes the first encrypted data, wherein the first terminal is assumed to be the target terminal.
  • the terminal that has not yet opened the virtual bank card, the second terminal is the original terminal, that is, the terminal that has opened several virtual bank cards, the original terminal pre-stores the first backup data, and the target terminal acquires the first backup data from the original terminal, as shown in FIG.
  • the method specifically includes the following steps:
  • the original terminal receives the first add bank card request.
  • the first adding bank card request is used to indicate that a bank card is added in the payment application, and the user can complete the operation of adding a bank card and generating a virtual bank card in the terminal according to the boot padding information.
  • the original terminal acquires a bank card account information image according to the first added bank card request.
  • the bank card account information image includes the front image of the physical bank card, or the front image of the physical bank card and the reverse image of the physical bank card, and the front image of the physical bank card and the reverse image of the physical bank card all contain bank card account information.
  • the front image of the physical bank card includes the image of the main card number and the expiration date
  • the reverse image of the physical bank card includes the image of the CVV.
  • the original terminal needs to obtain the front image of the physical bank card and the reverse image of the physical bank card.
  • the bank card account information image acquired by the terminal includes a front image of the physical bank card and a reverse image of the physical bank card.
  • the front image of the physical bank card includes the image of the main card number.
  • the original terminal only needs to obtain the front image of the physical bank card, and the bank card account information image acquired by the original terminal includes the front image of the physical bank card.
  • the original terminal can display the "scan input”, “sticker reading number” and “manual input” through the user interface (UI) to prompt the user, and the user himself or herself selects “scan input”, “sticker reading number” or “ Manual input”, so that the original terminal obtains bank card account information.
  • the bank card account information is preferably obtained by using a scan input manner;
  • the original terminal After receiving the scan input request, the original terminal starts the camera driver of the TEE control, opens the camera of the terminal, and scans the front side of the physical bank card and the reverse side of the physical bank card through the camera. It should be noted that if the original terminal does not set the "scan input” and "manual input” prompt functions, and directly set the scan entity bank card to obtain the bank card account information image, the original terminal directly starts after receiving the first add bank card request.
  • the TEE-controlled camera driver turns on the camera of the terminal and scans the front side of the physical bank card and the reverse side of the physical bank card through the camera.
  • the original terminal starts the OCR algorithm, uses the OCR algorithm to identify the front image of the physical bank card and the reverse image of the physical bank card, obtains the bank card account information such as the main card number, presents the bank card account information to the user through the TUI, and can prompt the user to confirm the bank. If the card account information is correct and saved, if the bank card account information is correct, the user can click "confirm” and / or "save” in the user interface.
  • the TUI can be visually consistent with that shown in FIG. 1 , but the difference is that the TUI depends on the software environment provided by the TEE.
  • the interface of the prior art FIG. 1 filling in the bank card is a graphical user interface (Graphical User Interface). , GUI), is the interface provided by the non-trusted environment.
  • the original terminal can also manually input the main card number on the user interface of the bank card account information. Or obtain the bank card account information by means of a card reading number, etc., the original terminal can convert the obtained bank card account information into a picture, and obtain a bank card account information image.
  • a preset algorithm may be adopted, for example, a fixed-size image with a background and a color and a texture is preset, and the bank card account information is processed and displayed on the preset image, and then synthesized into one included.
  • An image of digital information that is, a bank card account information image.
  • the original terminal performs image encryption processing on the bank card account information image according to an image processing algorithm in the protected operating environment to obtain the first encrypted bank card data.
  • the image processing algorithm After the original terminal obtains the bank card account information image according to the first added bank card request, the image processing algorithm performs image encryption processing on the bank card account information image to obtain the first encrypted bank card data.
  • the original terminal performs image encryption processing on the bank card account information image according to the image processing algorithm, so that the human eye or the OCR algorithm cannot recognize the bank card account information presented by the front image of the physical bank card and the reverse image of the physical bank card, for example, the main card number, Validity period and credit card security code, etc.
  • the image processing algorithm may randomly scramble each line for digital image encryption, randomly disorder each column for digital image encryption, and simultaneously scramble the columns and columns for encryption; randomly scramble pixel points for encryption; use chaotic sequences to perform encryption Digital image encryption, etc.
  • the above digital processing algorithm is implemented with reference to the book “Image Encryption Algorithm and Practice” (Standard Book No.: 978-7-03-037670-1).
  • the input interface can be displayed through the TUI, allowing the user to input or select an encryption parameter.
  • the original terminal encrypts the first encrypted bank card data by using the public key of the original terminal in the protected operating environment to obtain the second encrypted bank card data.
  • the original terminal performs image encryption processing on the bank card account information image according to the image processing algorithm, and obtains the first encrypted bank card data, and then encrypts the first encrypted bank card data by using the original terminal's public key to obtain the second encrypted bank card data. .
  • a public key and a private key are a pair of keys obtained by an algorithm, that is, a public key and a private key.
  • the public key is the part of the key pair that is exposed, and the private key is the non-public part.
  • Public keys are typically used to encrypt session keys, verify digital signatures, or encrypt data that can be decrypted with the corresponding private key.
  • the key pair obtained by this algorithm is guaranteed to be unique worldwide. When using this key pair, if one piece of data is used to encrypt a piece of data, it must be decrypted with another key. For example, encrypting data with a public key must be decrypted with a private key.
  • the public key of the original terminal refers to the public key contained in the terminal certificate stored in the operating environment protected by the original terminal (such as the trusted storage of TEE).
  • the data encrypted by the public key can be decrypted only by using its corresponding private key, and the private key is only grasped by the original terminal; therefore, the original terminal uses the data encrypted by the public key, and other entities may obtain the private of the original terminal even if acquired.
  • the key cannot be decrypted.
  • the original terminal sets an access password for the second encrypted bank card data, and obtains the first backup data.
  • the original terminal encrypts the first encrypted bank card data by using the public key of the original terminal, and obtains the second encrypted bank card data, and then sets an access password to the second encrypted bank card data to obtain the first backup data.
  • the access password set by the original terminal for the second encrypted bank card data may be a Personal Identification Number (PIN) or a fingerprint.
  • the first backup data is a bank card account information image encrypted by an image processing algorithm, a public key of the original terminal, and an access password.
  • the original terminal saves the first backup data in the trusted storage of the TEE of the original terminal, and saves the identifier of the image processing algorithm and the parameters used by the image processing algorithm in the eSE of the original terminal.
  • the original terminal sets an access password for the second encrypted bank card data, and after obtaining the first backup data, saves the first backup data in the trusted storage of the original terminal TEE, and uses the image processing algorithm identifier and the image processing algorithm.
  • the parameters are saved in the eSE of the original terminal.
  • the original terminal obtains the bank card account information, and requests the first server to activate the bank card
  • the user needs to input the mobile phone number associated with the bank card, and this time
  • the entered mobile phone number is encrypted by the original terminal's public key and stored in the TEE. It should be noted that the mobile phone number can be saved in the TEE after being converted into a picture, or can be directly encrypted and stored in the TEE.
  • the reverse image of the physical bank card may be processed by the image processing algorithm, and then encrypted by using the public key of the original terminal, and then saved in the eSE, and the PIN is set. Or fingerprint access password to get the first backup data.
  • the first backup data may include a front side image of the physical bank card stored in the TEE after encryption and a reverse image of the physical bank card stored in the eSE after being encrypted. Since the reverse image of the physical bank card contains CVV, the use of eSE preservation can further enhance security and prevent the risk of data being stolen.
  • the original terminal can securely obtain the bank card account information, and save the first backup data including the bank card account information in the TEE of the original terminal, or the TEE and the eSE, and use the image processing algorithm identifier and the image processing algorithm.
  • the parameters are stored in the eSE so that the original terminal can securely store the first backup data. Even if the first backup data is exported, the information cannot be recovered because the decryption key is missing.
  • Steps 501-506 disclose a method for backing up the bank card data by the NFC payment application, which may be executed as a backup process alone or as part of a complete process of adding a bank card, which is not limited in the embodiment of the present invention.
  • the target terminal receives the second add bank card request.
  • step 401 For details, refer to the detailed description in step 401, and details are not described herein again.
  • the target terminal sends a second add bank card request to the first server.
  • the target terminal After receiving the second adding bank card request, the target terminal sends a second adding bank card request to the first server, so that the first server generates a service serial number and a service credential for the target terminal, where the service credential includes the service serial number and the first server pair service serial number. Signature.
  • the second add bank card request contains the target terminal certificate.
  • the business credentials are used to prove that the target terminal obtains the bank card data business legally.
  • the first server After receiving the second request for adding a bank card, the first server verifies the identity of the target terminal.
  • the first server may obtain the target terminal certificate from the second add bank card request, and thereafter, the target terminal certificate may be verified by the certificate authority root certificate.
  • the certificate authority root certificate may be preset in the first server, or the first server may preset a root certificate that can verify the target terminal certificate chain.
  • the digital certificate is a certificate issued by a third-party institution with authority, trustworthiness and impartiality, that is, a certificate authority (CA) center, which is also called a “digital ID card”. Is an authoritative electronic document.
  • the contents of the certificate include: the information of the issuing authority, the user information, the validity period of the digital certificate, the user's public key and the signature of the issuing authority.
  • the simplest certificate contains a public key, a digital certificate name, and a digital signature for the certificate authority.
  • Digital signature refers to the use of a cryptographic algorithm to encrypt data, attach the encrypted data to the original text and send it together. This information is similar to the actual signature or seal, and the receiver can verify it.
  • Digital certificates are only valid for a specific period of time.
  • the purpose of the digital certificate is to prove that the user listed in the certificate legally owns the public key listed in the certificate.
  • the digital certificate issuance process is generally: the user first generates his own key pair, and the public key and part of the personal identity letter The information is transmitted to the certificate authority. After verifying the identity, the certificate authority will perform some necessary steps to ensure that the request is actually sent by the user. Then, the certificate authority will send the user a digital certificate containing the user's personal information and his public. The key information is also accompanied by the signature information of the certificate authority. Users can use their own digital certificates for a variety of related activities. Digital certificates are issued by independent certificate issuers. Digital certificates vary, and each certificate provides different levels of credibility.
  • the target terminal certificate is a digital certificate preset by the terminal manufacturer to the TEE or eSE of the target terminal, and its function is to identify that the target terminal has a protected operating environment (TEE or eSE); and can also be used in a specific service scenario. Identifies the identity of the terminal to the server.
  • the target terminal certificate is obtained by the terminal manufacturer sending a certificate issuance request to the CA, including the public key of the target terminal and the digital signature of the certificate authority to the public key of the target terminal.
  • the first server verifies the digital signature of the public key of the target terminal by using the certificate authority root certificate. If the verification succeeds, the first server verifies that the target terminal certificate is successful. Go to step 510.
  • the first server generates a service serial number.
  • the service number is generated by the first server, and is used to identify the sequence number of the added bank card request service sent by the target terminal to the first server.
  • the service sequence number is an identification information identifying a service, and identifies a specific type of service performed by a specific terminal.
  • the service serial number is used to identify that the target terminal uses the backup data to restore the virtual bank card service.
  • the service sequence number may also be saved by the first server and/or the second server to the log of the data migration service between the two terminals.
  • the first server signs the service serial number by using the private key of the first server, and generates a service credential.
  • the first server After the first server generates the service serial number, the first server signs the service serial number with the private key of the first server, and generates a service credential.
  • the business credentials include the service serial number and the signature of the first server to the service serial number.
  • the target terminal can use the first server certificate to verify the signature in the business credentials to ensure that the service serial number has not been tampered with.
  • the first server sends the service credential and the first server certificate to the target terminal.
  • the first server signs the service serial number with the first server private key, and after generating the service credential, sends the service credential and the first server certificate to the target terminal, where the first server certificate is used to verify the service credential, and the service serial number is not tampered.
  • the target terminal After receiving the service credential and the first server certificate, the target terminal saves the service credential in the TEE of the target terminal.
  • RAM random access memory
  • non-volatile memory a non-volatile memory
  • the target terminal sends a service sequence number to the second server.
  • the target terminal decrypts the service credential by using the received first server certificate, obtains the service serial number, and sends the service serial number to the second server.
  • the second server After receiving the service serial number, the second server signs the service serial number with the private key of the second server, and generates the identity credential.
  • the identity credential is used to prove that the account registered in the target terminal is legal, and the identity credential includes the service serial number and the signature of the second server to the service serial number.
  • the second server sends the identity credential to the target terminal.
  • the second server After receiving the service serial number, the second server signs the service serial number with the second server private key, and generates the identity After that, the identity credentials are sent to the target terminal.
  • the target terminal After receiving the identity credential, the target terminal saves the identity credential in the TEE of the target terminal.
  • Step 507 - Step 517 is a process in which the target terminal acquires the verification credential, and the verification credential includes the business credential and the identity credential, and its execution is not restricted by the steps 501-506.
  • the target terminal establishes a point-to-point wireless communication connection with the original terminal.
  • the target terminal can establish a point-to-point wireless communication connection with the original terminal through BT, NFC or Wi-Fi P2P.
  • the target terminal verifies the original terminal certificate.
  • the target terminal receives the original terminal certificate and verifies the original terminal certificate through the certificate authority root certificate. It should be noted that step 519 is optional, and step 520 may also be directly performed.
  • step 520 is performed.
  • the target terminal sends a request for acquiring bank card data to the original terminal by using a point-to-point wireless communication connection.
  • the request to obtain bank card data includes a verification credential and a target terminal certificate, and the verification credential includes a business credential and an identity credential.
  • the request for obtaining the bank card data may only include the verification credential or only the target terminal certificate;
  • the original terminal After receiving the request for obtaining the bank card data, the original terminal verifies the service credential, the identity credential, and the target terminal certificate.
  • the original terminal after receiving the bank card data migration request sent by the target terminal, the original terminal obtains the service credential, the identity credential, and the target terminal certificate from the request, and performs verification; the original terminal may use the root certificate preset in the terminal or connect the terminal.
  • the certificate authority root certificate obtained by the certificate center server verifies the target terminal certificate, and the original terminal can verify the service credential by using the obtained first server certificate, and the original terminal can use the obtained second server certificate to perform the identity credential.
  • the original terminal may also connect the first server and the second server respectively, obtain the first server certificate from the first server, obtain the second server certificate from the second server, and then verify the business credentials by using the first server certificate, and use the second
  • the server certificate verifies the identity credentials.
  • step 522 is performed.
  • the user may prompt the user to verify the success.
  • the original terminal may perform the step 522 only if the verification credential is successful, or the original terminal may only verify that the target terminal certificate is successful.
  • the original terminal decrypts the first backup data in the TEE, and obtains the first encrypted bank card data.
  • the first backup data is decrypted by using the access password
  • the second encrypted bank card data is obtained
  • the second encrypted bank card data is performed by using the private key of the original terminal. Decrypt, obtain the first encrypted bank card data.
  • the original terminal obtains the reverse side image of the encrypted physical bank card from the eSE and decrypts the private key of the original terminal in the TEE to obtain the first encrypted bank card data.
  • the original terminal generates the first encrypted data in the TEE.
  • the original terminal encrypts the first encrypted bank card data, the image processing algorithm identifier, and the parameters used by the image processing algorithm by using the public key of the target terminal, and encrypts the first encryption by the public key of the target terminal by using the private key of the original terminal.
  • Bank card data, identification of image processing algorithms, and parameters used by image processing algorithms are signed,
  • the first encrypted data is obtained.
  • the public key of the target terminal can be obtained from the target terminal certificate, and the target terminal certificate includes the public key of the target terminal.
  • the original terminal stores the private key of the original terminal in the TEE, that is, the private key corresponding to the terminal certificate of the original terminal.
  • the original terminal sends the first encrypted data to the target terminal by using a point-to-point wireless communication connection.
  • the first terminal transmits the first encrypted data to the target terminal.
  • the original terminal sends a bank card data migration response to the target terminal through the point-to-point wireless communication connection, and the bank card data migration response is a response of the original terminal to the bank card data migration request sent by the target terminal, including the first encrypted data, and the first encrypted data includes The first encrypted private card signature of the original terminal and the first encrypted bank card data of the target terminal's public key encryption, the image processing algorithm identifier, and the parameters used by the image processing algorithm.
  • the target terminal After receiving the first encrypted data, the target terminal acquires the bank card account information according to the first encrypted data in the TEE.
  • the target terminal After the original terminal transmits the first encrypted data to the target terminal through the point-to-point wireless communication connection, the target terminal receives the first encrypted data through the point-to-point wireless communication connection.
  • the target terminal may also receive the bank card data migration response sent by the original terminal, and the target terminal acquires the first encrypted data from the bank card data migration response.
  • the target terminal After receiving the first encrypted data through the point-to-point wireless communication connection, the target terminal acquires the bank card account information according to the first encrypted data. For example, since the first encrypted data is encrypted by the private key of the original terminal and the public key of the target terminal, after receiving the first encrypted data sent by the original terminal, the target terminal prefers to use the original terminal certificate to verify the privateness of the original terminal.
  • the parameters used by the algorithm call the local image processing algorithm to decrypt the first encrypted bank card data, and obtain the bank card account information image, that is, the front image of the physical bank card, or the front image of the physical bank card and the reverse image of the physical bank card, and the target terminal
  • the virtual bank card to be activated can be displayed on the user interface, as shown in FIG. Then, the bank card account information image is processed by the OCR algorithm to obtain bank card account information.
  • the user selects the virtual bank card to be activated, and the target terminal processes the bank card account information image by using the OCR algorithm, and obtains the bank card account information, including the PAN, the validity period, and the CVV.
  • the mobile phone number associated with the card is also obtained.
  • an activation virtual bank card request can be generated to request activation of the virtual bank card from the first server and download to the target terminal.
  • the target terminal sends a card opening request to the first server.
  • the target terminal After acquiring the bank card account information according to the first encrypted data, the target terminal sends a card opening request to the first server, thereby adding a bank card in the first terminal, and the card opening request includes the bank card account information.
  • the target terminal sends an activation request to the first server, the activation request includes bank card account information, and may also include a card associated mobile phone number.
  • the first server verifies the bank card information, sends a verification code to the associated mobile phone number, and receives the verification code returned by the target terminal (this verification code is automatically filled or received by the user after receiving the verification code), at this time, the first server It can be determined that the card information is correct and the cardholder passes the verification.
  • the first server sends an activation response to the target terminal.
  • the activation response contains data related to a virtual bank card generated by the first server based on the bank card account information contained in the activation request.
  • the target terminal receives an activation response sent by the first server.
  • the activation response is used by the target terminal to activate the bank card corresponding to the bank card account information.
  • the target terminal sends the bank card account information to the first server, and the first server verifies the account letter.
  • the virtual bank card token and the virtual bank card key are returned to the target terminal (the key is stored in the eSE, and the transaction is used to identify whether the card is legal) and the like.
  • the target terminal configures the Token and the card key in the eSE to activate the virtual bank card to be activated.
  • the cardholder verification can be performed at the original terminal, and the original terminal receives the verification code and sends the verification code to the target terminal through a point-to-point wireless communication connection (or the user can input the verification code received by the original terminal on the target terminal), and the target terminal will be the bank.
  • the card account information is sent to the first server together with the verification code sent by the original terminal, and the first server confirms that the submitted information is correct, and then returns data such as a token and a key, and is configured in the eSE, thereby activating the virtual bank card to be activated.
  • the Token token is a hardware for identifying the identity.
  • the Token is the meaning of “symbol, representative”, that is, the virtual bank card number is a representative of the physical bank card primary account PAN.
  • the user submits the main card number and additional information of a physical bank card to the first server through the mobile phone, and the first server sends a "representative" of the physical card to the mobile phone, and the mobile phone saves the representative in the eSE, and the representative is actually virtual
  • the card's main card number is generated by the first server according to the physical card number, and the first server saves the mapping relationship between the Token number and the physical card number; when the mobile phone submits the Token to a PoS machine for consumption, the consumption request is submitted to the first The server, the first server will translate it into a physical card number, and then send a deduction request to a specific bank; it can be seen that the mobile phone saves the Token number instead of the physical card number, which reduces the possibility of leaking the user card number through the mobile phone, and improves the possibility.
  • Security in the transaction, in addition to submitting the Token, the mobile phone also submits other card keys saved by eSE to PoS, further Strong safety performance; phone card number if you
  • step 527 and step 528 are performed.
  • the target terminal sends a first logout message to the first server.
  • the first logout message is used to instruct the first server to log out the business credentials.
  • the target terminal sends a second logout message to the second server.
  • the second logout message is used to instruct the second server to log out the identity credential.
  • the target terminal sends a request to cancel the service credential to the first server, and sends a request for the logout credential to the second server to log off the two credentials to prevent the replay attack.
  • the method for adding a bank card provided by the embodiment of the present invention saves the backed up bank card data by using the secure memory in the protected running environment in the original terminal, and restores the backed bank card through the point-to-point wireless communication connection after verifying the identity of the target terminal successfully.
  • the data is sent to the target terminal, so that it is not necessary to repeat the relevant verification information when recovering the bank card on the target terminal, thereby minimizing user input and thereby improving the user experience.
  • FIG. 9 is a flowchart of a method for adding a bank card according to an embodiment of the present invention, which refines the case where the bank card data shown in FIG. 5 includes the second encrypted data, wherein the first terminal is assumed to be the target terminal.
  • the terminal that has not yet opened the virtual bank card the second terminal is the original terminal, that is, the terminal that has opened several virtual bank cards, the original terminal pre-stores the second backup data, and the target terminal acquires the second backup data from the original terminal, as shown in FIG.
  • the method specifically includes the following steps:
  • the original terminal receives the first add bank card request.
  • step 501 For details, refer to the detailed description in step 501, and details are not described herein again.
  • the original terminal acquires the migration data according to the first added bank card request.
  • the original terminal After receiving the first add bank card request, the original terminal obtains the number of migrations according to the first added bank card request. according to.
  • the migration data includes the last four digits of the PAN of the one or more bank cards to which the original terminal has been bound and the BIN.
  • the original terminal obtains the bank card account information image, and then processes the bank card account information image according to the OCR algorithm to obtain the bank card account information, and then extracts the migration data from the bank card account information, wherein the original terminal obtains the bank card.
  • the account information image, and the method for processing the bank card account information image according to the OCR algorithm, and the method for obtaining the bank card account information may be referred to in step 502, and details are not described herein again.
  • the original terminal encrypts the migration data by using the public key of the original terminal to obtain the second backup data.
  • the original terminal After the original terminal obtains the migration data according to the first added bank card request, the original terminal encrypts the migration data by using the public key of the original terminal to obtain the second backup data.
  • the second backup data is migration data encrypted by the public key of the original terminal.
  • the original terminal saves the second backup data in the TEE.
  • the original terminal encrypts the migration data by using the public key of the original terminal, and after obtaining the second backup data, saves the second backup data in the TEE.
  • the original terminal sends a cache request to the first server.
  • the original terminal After the original terminal saves the second backup data in the TEE, it sends a cache request to the first server.
  • the cache request includes the last four digits of the PAN of the bank card and the terminal certificate of the original terminal.
  • the cache request is used to request the first server to associate the bank card terminal account information related to the last four digits of the PAN with the original terminal certificate.
  • the first server stores in advance bank card account information related to the last four digits of the PAN.
  • the first server may also use the access password PIN1 to associate with the bank card account information, and send the PIN1 to the original terminal.
  • the original terminal encrypts the PIN1 with the public key of the original terminal and saves it in the TEE of the original terminal, and the original terminal sets A PIN2 or fingerprint is used to control access to PIN1. That is, the bank account information cached by the first server can be protected by at least one password restriction.
  • the first server After receiving the cache request, the first server associates the bank card account information related to the last four digits of the PAN with the original terminal certificate.
  • the bank card account information related to the last four digits of the PAN is associated with the original terminal certificate, that is, the mapping relationship between the two is saved.
  • Steps 601-606 are a process in which the original terminal sends a request to the first server to save the bank card account related data on the server side, and generally, when the bank card is added to the original terminal.
  • Steps 607 to 621 are the same as steps 507 to 521 shown in FIG. 6, and details are not described herein again.
  • the original terminal decrypts the second backup data in the TEE to obtain the migrated data.
  • the original terminal decrypts the second backup data by using the private key of the original terminal, and obtains the migrated data, that is, the last four digits of the PAN number and the BIN.
  • the original terminal also uses the private key of the original terminal to sign the migration data.
  • the original terminal generates second encrypted data.
  • the original terminal decrypts the second backup data, and after obtaining the migrated data, generates the second encrypted data.
  • the original terminal encrypts the migration data and the original terminal's signature of the migration data through the public key of the target terminal certificate, and uses the private key of the original terminal to sign the migration data encrypted by the public key of the target terminal to obtain the second encrypted data.
  • the public key of the target terminal can be obtained from the target terminal certificate, and the target terminal certificate includes the public key of the target terminal.
  • the original terminal stores the private key of the original terminal in the TEE.
  • the private key corresponds to the public key in the original terminal certificate, and is a pair. Asymmetric key.
  • the original terminal sends the second encrypted data to the target terminal.
  • the second encrypted data is transmitted to the target terminal through the point-to-point wireless communication connection.
  • the original terminal sends a bank card data migration response to the target terminal through a point-to-point wireless communication connection, the bank card data migration response is a response of the original terminal to the bank card data migration request sent by the target terminal, and the bank card data migration response includes the second encrypted data,
  • the second encrypted data includes migration data encrypted by the private key of the original terminal and the public key of the target terminal.
  • the original terminal sends a target terminal certificate to the first server.
  • the first server After receiving the target terminal certificate sent by the original terminal, the first server associates the target terminal certificate with the bank card account information.
  • the first server can check the identity of the target terminal by using the target terminal certificate provided by the original terminal, that is, compare the certificate of the terminal requesting the data acquisition with the original terminal. Whether the certificates sent are consistent. It should be noted that steps 625 and 626 are optional.
  • the target terminal After receiving the second encrypted data, the target terminal decrypts the second encrypted data to obtain the migrated data and the signature of the original terminal to the migrated data.
  • the original terminal's public key is used to verify the original terminal's private key. Signing, and decrypting the first encrypted data by using the private key of the target terminal, and obtaining the migrated data, that is, the last four digits of the PAN number and the BIN, and the signature of the migrated data.
  • the target terminal sends the target terminal certificate, the migration data, and the signature of the original terminal to the migration data to the first server.
  • the first server After receiving the first terminal certificate, the migration data, and the signature of the second terminal to the migration data, the first server confirms the identity of the target terminal.
  • the first server may preset the root certificate of the CA that issued the target terminal certificate, verify the target terminal certificate by using the root certificate, and confirm that the target terminal is a legitimate terminal.
  • the first server may also compare the target terminal certificate sent by the original terminal with the terminal certificate included in the activation request, the two certificates, and verify that the target terminal is legal by the root certificate.
  • the first server sends the bank card account information to the target terminal.
  • the obtaining password may be requested, and the obtaining password may be provided by the original terminal or obtained by the interface of the target terminal.
  • the first terminal After receiving the bank card account information, the first terminal sends a card opening request to the first server.
  • the target terminal may use the bank card account information and the mobile phone number reserved by the user to generate a virtual card request and submit the request to the first server, and the first server returns the SMS verification code to the pre-request. Leave the mobile phone number, the target terminal obtains the SMS verification code, and submits it to the first server. If the first server verifies correctly, it determines that the cardholder has passed the verification, and returns the virtual bank card data, ie the token and the virtual bank card key, to the target terminal. Generate a bank card on the terminal; adjust the bank card status to normal. For details, refer to the detailed description in step 526, and details are not described herein again.
  • step 632 and step 633 are performed.
  • the target terminal sends a first logout message to the first server.
  • the first logout message is used to instruct the first server to log out the business credentials.
  • the target terminal sends a second logout message to the second server.
  • the second logout message is used to instruct the second server to log out the identity credential.
  • the target terminal sends a request to cancel the service credential to the first server, and sends a request for the logout credential to the second server to log off the two credentials to prevent the replay attack.
  • the method for adding a bank card provided by the embodiment of the present invention saves the backed up bank card data by using the secure memory in the protected running environment in the original terminal, and restores the backed bank card through the point-to-point wireless communication connection after verifying the identity of the target terminal successfully.
  • the data is sent to the target terminal, so that it is not necessary to repeat the relevant verification information when recovering the bank card on the target terminal, thereby minimizing user input and thereby improving the user experience.
  • FIG. 10 is a flowchart of a method for adding a bank card according to an embodiment of the present invention.
  • the first server sets an obtaining credential for obtaining bank card data and saves it in the first
  • the second terminal when the first terminal uses the obtained credentials to obtain the bank card data, the user can quickly recover the device card by simply performing the simple authentication, wherein the first terminal is the target terminal, that is, the terminal that has not opened the virtual bank card,
  • the second terminal is the original terminal, that is, the terminal that has opened several virtual bank cards.
  • the method specifically includes the following steps:
  • the original terminal obtains bank card data.
  • the original terminal After the original terminal successfully adds the bank card, it receives the memo data request and pops up the user authentication interface; verifies whether the current user of the original terminal is a legitimate user of the payment application; after the verification succeeds, the user prompts the user to select the virtual bank card to be migrated through the UI interface.
  • the original terminal sends a backup request to the first server.
  • the original terminal determines the selected bank card, and sends a backup request to the first server.
  • the backup request includes the token corresponding to the bank card, the Token validity period, and the data encrypted by the bank card key, for example, the challenge value provided by the TSP or the backup card generated by the original terminal. Generate a request.
  • the above data can also be signed using the private key of the original terminal.
  • the first server After receiving the backup request, the first server verifies the Token and the key encrypted data, and confirms that it is a backup request generated by a legitimate bank card.
  • the first server generates a backup Token corresponding to the Token submitted by the original terminal and an obtaining token of the backup Token.
  • the obtained credentials are encrypted using the public key of the original terminal.
  • the first server sends a backup response to the original terminal.
  • the backup response includes the backup token's acquisition credentials.
  • the original terminal After receiving the backup response, the original terminal saves the obtained credentials in the TEE or eSE of the original terminal.
  • the backup Token and the Token provided by the original terminal are generated by the same PAN, and the backup token can be used to obtain the backup Token from the server.
  • the target terminal establishes a point-to-point wireless communication connection with the original terminal.
  • the target terminal can establish a point-to-point wireless communication connection with the original terminal through BT, NFC or Wi-Fi P2P.
  • both the target terminal and the original terminal are logged into the same account of the payment application.
  • the target terminal sends the identity credential to the original terminal by using a point-to-point wireless communication connection.
  • the identity credential can be the certificate of the target terminal.
  • the original terminal After receiving the identity credential sent by the target terminal, the original terminal verifies the identity credential.
  • the original terminal may preset the CA root certificate to verify the target terminal certificate; optionally, the original terminal may use the root certificate in the original terminal TEE certificate chain to verify the certificate of the target terminal; if the verification succeeds, the target terminal is confirmed to be a legitimate terminal.
  • the original terminal sends a certificate confirming the legal terminal to the first server.
  • the original terminal generates encrypted data.
  • the original terminal encrypts all backup Token acquisition credentials and bank card thumbnails with the target terminal certificate public key and sends them to the target terminal.
  • the original terminal may send the certificate of the target terminal to the first server.
  • the original terminal sends the encrypted data to the target terminal by using a point-to-point wireless communication connection.
  • the target terminal After the target terminal receives the encrypted data sent by the original terminal, the target terminal displays all the bank cards to be activated in the card package interface according to the bank card thumbnail, and each bank card is associated with a backup Token to obtain the credentials.
  • the target terminal receives the activation selection of the user, and submits at least one backup Token obtaining credential and a target terminal certificate to the first server.
  • the first server verifies the target terminal certificate by using the preset CA root certificate.
  • the first server compares the target terminal certificate sent by the original terminal, and the certificate provided by the target terminal is consistent with the verification of the CA root certificate. It is a legal terminal; after that, the backup Token and the related key are sent to the target terminal, and the target terminal receives the backup Token and the related key, and then saves it to the eSE. Finally, the target terminal modifies the status of the bank card that received the backup Token to the active state.
  • each network element for example, the first terminal and the second terminal, in order to implement the above functions, includes corresponding hardware structures and/or software modules for performing respective functions.
  • the present invention can be implemented in a combination of hardware or hardware and computer software in combination with the algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.
  • the embodiment of the present invention may perform the division of the function modules on the first terminal and the second terminal according to the foregoing method example.
  • each function module may be divided according to each function, or two or more functions may be integrated into one processing module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of the module in the embodiment of the present invention is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 11 is a schematic diagram showing a possible configuration of the first terminal involved in the foregoing embodiment.
  • the first terminal 80 may include: The connection unit 801, the reception unit 802, the processing unit 803, and the transmission unit 804.
  • connection unit 801 is configured to support step 402 in the method for adding the bank card shown in FIG. 5 by the first terminal, step 518 in the method for adding the bank card shown in FIG. 7, and the adding bank shown in FIG. Step 618 in the method of card, step 707 in the method of adding a bank card shown in FIG.
  • the receiving unit 802 is configured to support steps 401 and 406 in the method for adding the bank card shown in FIG. 5, and steps 507, 513, 517, and 525 in the method for adding the bank card shown in FIG. 9 Steps 607, 613, 617, and 627 in the method of adding a bank card, and step 712 in the method of adding a bank card shown in FIG.
  • the processing unit 803 is configured to support the step 407 in the method for adding the bank card shown in FIG. 5 by the first terminal, the steps 519 and 525 in the method for adding the bank card shown in FIG. 7, and the adding bank shown in FIG. Steps 619, 627 in the card method.
  • the sending unit 804 is configured to support steps 403 and 408 in the method for adding the bank card shown in FIG. 5, and steps 508, 514, 526, 527, and 528 in the method for adding the bank card shown in FIG. Steps 608, 614, 628, 631, 632, and 633 in the method of adding a bank card shown in FIG. 9, and step 713 in the method of adding a bank card shown in FIG.
  • the first terminal provided by the embodiment of the present invention is configured to execute the foregoing method for adding a bank card, so that the same effect as the method for adding a bank card described above can be achieved.
  • FIG. 12 shows another possible composition diagram of the first terminal involved in the above embodiment.
  • the first terminal 90 includes a processing module 901 and a communication module 902.
  • the processing module 901 is configured to perform control and management on the action of the first terminal.
  • the processing module 901 is configured to support the first terminal to perform step 407 in the terminal shown in FIG. 5, in the method for adding a bank card shown in FIG. Step 519, step 619 in the method of adding a bank card shown in FIG. 9, and/or other processes for the techniques described herein.
  • the communication module 902 is configured to support communication between the first terminal and other network entities, such as communication between the first server and the second server shown in FIGS. 5, 7, 9, and 10.
  • the first terminal may further include a storage module 903 for storing program codes and data of the first terminal.
  • the processing module 901 can be a processor or a controller. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor can also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication module 902 can be a transceiver, a transceiver circuit, a communication interface, or the like.
  • the storage module 903 can be a memory.
  • the processing module 901 is a processor
  • the communication module 902 is a communication interface
  • the storage module 903 is a memory
  • the first terminal involved in the embodiment of the present invention may be the terminal shown in FIG.
  • FIG. 13 is a schematic diagram showing a possible configuration of the second terminal involved in the foregoing embodiment.
  • the second terminal 100 may include: The connection unit 1001, the reception unit 1002, the processing unit 1003, and the transmission unit 1004.
  • connection unit 1001 is configured to support step 402 in the method for adding the bank card shown in FIG. 5 by the first terminal, step 518 in the method for adding the bank card shown in FIG. 7, and the adding bank shown in FIG. Step 618 in the method of card, step 707 in the method of adding a bank card shown in FIG.
  • the receiving unit 1002 is configured to support the step 404 in the method for adding the bank card shown in FIG. 5 by the second terminal, the steps 501 and 521 in the method for adding the bank card shown in FIG. 7, and the adding bank shown in FIG. Steps 601 and 621 in the method of the card, and step 706 in the method of adding the bank card shown in FIG.
  • the processing unit 1003 is configured to support steps 502 to 506, 522, and 523 in the method for adding the bank card shown in FIG. 7 to the second terminal, and steps 602 to 604 and 621 in the method for adding the bank card shown in FIG. , 622, 623, steps 709, 710 in the method of adding a bank card shown in FIG.
  • the sending unit 1004 is configured to support step 405 in the method for adding the bank card shown in FIG. 5, the step 524 in the method for adding the bank card shown in FIG. 7, and the adding bank card shown in FIG. Steps 605, 624, and 625 in the method, and steps 702 and 711 in the method of adding a bank card shown in FIG.
  • the second terminal provided by the embodiment of the present invention is configured to execute the foregoing method for adding a bank card, so that the same effect as the method for adding a bank card described above can be achieved.
  • FIG. 14 shows another possible composition diagram of the second terminal involved in the above embodiment.
  • the second terminal 110 includes a processing module 1101 and a communication module 1102.
  • the processing module 1101 is configured to perform control management on the action of the second terminal.
  • the communication module 1102 is for supporting communication between the second terminal and other network entities, such as the communication between the first server and the second server shown in FIGS. 5, 7, 9, and 10.
  • the second terminal may further include a storage module 1103 for storing program codes and data of the second terminal.
  • the processing module 1101 can be a processor or a controller. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor can also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication module 1102 can be a transceiver, a transceiver circuit, a communication interface, or the like.
  • the storage module 1103 can be a memory.
  • the processing module 1101 is a processor
  • the communication module 1102 is a transceiver
  • the storage module 1103 is a memory
  • the second terminal involved in the embodiment of the present invention may be the terminal shown in FIG.
  • the disclosed apparatus and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the modules or units is only a logical function division.
  • there may be another division manner for example, multiple units or components may be used.
  • the combination may be integrated into another device, or some features may be ignored or not performed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may be one physical unit or multiple physical units, that is, may be located in one place, or may be distributed to multiple different places. . Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a readable storage medium.
  • the technical solution of the embodiments of the present invention may contribute to the prior art or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a device (which may be a microcontroller, chip, etc.) or a processor to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • General Business, Economics & Management (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Finance (AREA)
  • Microelectronics & Electronic Packaging (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

本发明实施例公开了一种添加银行卡的方法及装置，涉及终端领域，解决了用户在终端上开通虚拟银行卡时，信息输入过程非常繁琐，用户体验差的问题。具体方案为：第一终端接收添加银行卡的请求；第一终端建立与第二终端的点对点无线通信连接；第一终端向第二终端发送获取银行卡数据的请求；第一终端接收第二终端发送的银行卡数据；第一终端根据银行卡数据获取银行卡账户信息；第一终端向第一服务器发送开卡请求，从而在第一终端中添加银行卡，开卡请求包括银行卡账户信息。本发明实施例用于提高用户体验。

Description

一种添加银行卡的方法及装置
本申请要求于2017年1月25日提交中国专利局、申请号为201710061359.3、发明名称为“一种设备卡数据处理的方法和设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明实施例涉及终端领域，尤其涉及一种添加银行卡的方法及装置。
背景技术
苹果支付(Apple Pay)、三星支付(Samsung Pay)、华为支付(Huawei Pay)和小米支付(Mi Pay)等支付应用，是由终端厂商联合卡组织和发卡方等机构开发的基于终端中的嵌入式安全单元(Embedded Secure Element，eSE)和近场通信(Near Field Communication，NFC)通信接口的支付应用，允许用户将自己拥有的信用卡或借记卡等实体银行卡绑定到终端中，形成虚拟银行卡，其中，卡组织可以是中国银联；发卡方可以是中国银行等国有银行，以及招商银行等商业银行。实体银行卡绑定到终端形成虚拟银行卡之后即可利用终端贴NFC销售点(Point of Sale，POS)机的读卡器，此动作也称为“拍Tap”，即可完成贴卡支付，依照银联的叫法即“闪付”。需要说明的是，虚拟银行卡数据包括支付令牌(Token)和支付密钥等保存于eSE中，eSE具有不低于实体银行卡的安全存储能力，是可靠的虚拟银行卡载体。将实体银行卡绑定到终端中生成的虚拟银行卡也称为设备卡。
现有技术中，实体银行卡绑定到终端生成虚拟银行卡的过程中，首先需要通过拍摄卡片上的卡号、打开终端NFC功能读取银行卡号或用户手动输入银行卡账户信息，例如，主账号(Primary Account Number，PAN)、有效期和信用卡安全码(Card Verification Value，CVV)等，然后，进行一次持卡人验证。具体的，如图1所示，为实体银行卡绑定到终端生成虚拟银行卡的过程示意图。
对于发卡方，将实体银行卡绑定到终端生成虚拟银行卡的过程相当于一次传统的在线支付，需要通过校验银行卡账户信息或取款密码，以及通过向持卡人预留手机号发送短信验证码的方式验证持卡人身份，这是银行卡交易安全所要求的。
然而，每个终端的支付应用的用户都可能拥有多张借记卡或信用卡，可能在自己的支付应用中绑定多张卡片以便获得不同银行的优惠。目前智能手机使用1-3年后可能会更新换代，或者终端故障后维修时恢复出厂设置后，都需要重新将实体银行卡绑定到终端。目前终端厂商设计的终端支付应用，不会保存银行卡账户信息，而eSE中保存的虚拟银行卡数据也不允许被复制出，因此添加实体银行卡到新终端只能通过输入银行卡账户信息并执行持卡人验证的方式，用户目前只能逐一地将实体银行卡重新绑定到新终端或维修后返回的终端上，由于信息输入过程非常繁琐，用户体验差。
发明内容
本发明实施例提供一种添加银行卡的方法及装置，能够有效地提高用户体验。
为解决上述技术问题，本发明实施例提供如下技术方案：
本发明实施例的第一方面，提供一种添加银行卡的方法，应用于具有受保护的运行环境的第一终端中，方法包括：首先，第一终端接收添加银行卡的请求；然后，第一终端建立与第二终端的点对点无线通信连接，向第二终端发送获取银行卡数据的请求；第一终端接收到第二终端发送的银行卡数据后，根据银行卡数据获取银行卡账户信息；第一终端再向第一服务器发送开卡请求，从而在第一终端中添加银行卡，其中，开卡请求包括了银行卡账户信息。本申请实施例所述的第一终端通过与第二终端点对点无线通信连接，从第二终端获取相关银行卡账户信息的备份数据，利用备份数据将实体银行卡绑定到第一终端生成虚拟银行卡，无需用户在第一终端通过非自动化的方式(拍照、NFC读取或手工输入)输入银行卡账户信息开卡，简化了用户操作步骤，有效地提高了用户体验。需要说明的是，受保护的运行环境是可信执行环境(Trusted Execution Environment，TEE)或安全单元(Secure Element，SE)。在终端中，SE有三种存在形式：以固定在终端主板上的独立芯片存在的eSE，或者集成于客户识别模块(Subscriber Identification Module，SIM)卡中，通过SIM卡槽接入和连接到终端的SIM SE，或者集成于微处理器(micro)安全数字存储卡(Secure Digital Memory Card，SD)卡中，通过SD卡槽接入并通过通用串行总线(Universal Serial Bus，USB)接口连接到终端的SD SE。后两种SE是外接的可移除的，而eSE固化在终端中的。
为了简化了用户操作步骤，有效地提高了用户体验，结合第一方面，在一种可能的实现方式中，在第一终端接收添加银行卡的请求之后，在第一终端建立与第二终端的点对点无线通信连接之前，方法还包括：在第一终端的显示屏幕上至少显示第一选项和第二选项，其中，第一选项为输入银行卡号或扫描银行卡或贴卡读号，第二选项为从其他终端获取银行卡数据。
为了简化了用户操作步骤，有效地提高了用户体验，结合上述可能的实现方式，在另一种可能的实现方式中，方法还包括：在第二选项下方显示至少一个其他终端的标识；或，在第一终端接收了用户对第二选项的选择后，显示至少一个其他终端的标识；其中，其他终端包括第二终端，其他终端与第一终端使用同一账号登陆。
结合上述可能的实现方式，在另一种可能的实现方式中，第一终端向第二终端发送获取银行卡数据的请求，具体包括：第一终端通过点对点无线通信连接向第二终端发送验证凭据和/或第一终端证书；其中，验证凭据包含业务凭据和身份凭据，第一终端证书是预置在第一终端的TEE中的终端证书，业务凭据用于证明第一终端获取银行卡数据的业务合法，身份凭据用于证明第一终端中登陆的账号合法。从而，第一终端通过向第二终端发送验证凭据和/或第一终端证书，来获取银行卡数据，提高了获取银行卡数据的安全性。
结合上述可能的实现方式，在另一种可能的实现方式中，第一终端接收第二终端发送的银行卡数据，具体包括：第一终端接收第二终端发送的第一加密数据，其中，第一加密数据包括通过第二终端的私钥签名和第一终端的公钥加密的第一加密银行卡数据、图像处理算法的标识和图像处理算法使用的参数，第一加密银行卡数 据包括银行卡账户信息图像，银行卡账户信息图像包括银行卡账户信息，银行卡账户信息用于标识银行卡；或，第一终端接收第二终端发送的第二加密数据，其中，第二加密数据包括通过第二终端的私钥签名和第一终端的公钥加密的迁移数据，迁移数据包括PAN后四位和银行标识代码(Bank Identification Number，BIN)。从而，为了简化了用户操作步骤，有效地提高了用户体验，本申请实施例提供一种获取到的银行卡数据的具体的实现方式，第二终端提供给第一终端的银行卡数据包括第一加密数据或第二加密数据，使第一终端根据银行卡数据来开卡。
结合上述可能的实现方式，在另一种可能的实现方式中，第一终端在受保护的运行环境中根据银行卡数据获取银行卡账户信息，从而，提高了第一终端获取银行卡账户信息的安全性。
结合上述可能的实现方式，在另一种可能的实现方式中，第一终端根据银行卡数据获取银行卡账户信息包括：第一终端在TEE中利用第二终端的公钥验证第二终端的私钥签名，并利用第一终端的私钥解密第一加密数据，得到第一加密银行卡数据、图像处理算法的标识和图像处理算法使用的参数；第一终端在TEE中根据与图像处理算法的标识对应的图像处理算法和图像处理算法使用的参数，解密第一加密银行卡数据，得到银行卡账户信息图像；第一终端在TEE中利用光学字符识别(Optical Character Recognition，OCR)算法处理银行卡账户信息图像，得到银行卡账户信息。从而，通过公钥和私钥对第一终端和第二终端传输的银行卡数据进行加密和解密，获取银行卡账户信息，有效地提高了获取银行卡数据的安全性。
结合上述可能的实现方式，在另一种可能的实现方式中，第一终端根据银行卡数据获取银行卡账户信息包括：第一终端在TEE中利用第二终端的公钥验证第二终端的私钥签名，并利用第一终端的私钥解密第二加密数据，得到迁移数据；第一终端向第一服务器发送第一终端证书、迁移数据和第二终端对迁移数据的签名；第一终端接收第一服务器发送的银行卡账户信息。从而，通过公钥和私钥对第一终端和第二终端传输的银行卡数据进行加密和解密，获取银行卡账户信息，有效地提高了获取银行卡数据的安全性。
结合上述可能的实现方式，在另一种可能的实现方式中，在第一终端接收了用户对第二选项的选择后，方法还包括：第一终端从第一服务器获取业务凭据，业务凭据包括业务序号和第一服务器对业务序号的签名；第一终端在TEE中保存业务凭据。本发明实施例提供一种获取业务凭据的具体实施方式，从而，有效地提高获取银行卡数据的安全性。
结合上述可能的实现方式，在另一种可能的实现方式中，方法还包括：第一终端使用与第二终端相同的账号向第二服务器发送业务序号；第一终端接收第二服务器发送的身份凭据，身份凭据包括业务序号和第二服务器对业务序号的签名；第一终端在TEE中保存身份凭据。本发明实施例提供一种获取身份凭据的具体实施方式，从而，有效地提高获取银行卡数据的安全性。
结合上述可能的实现方式，在另一种可能的实现方式中，第一终端向第一服务器发送第一注销消息，第一注销消息用于指示第一服务器注销业务凭据；或/和，第一终端向第二服务器发送第二注销消息，第二注销消息用于指示第二服务器注销身 份凭据。从而，第一终端向第一服务器发送注销业务凭据的请求，向第二服务器发送注销身份凭据的请求，以便注销两个凭据，防止重放攻击。
本发明实施例的第二方面，提供一种添加银行卡的方法，应用于具有受保护的运行环境的第二终端中，包括：第二终端建立与第一终端的点对点无线通信连接；第二终端接收第一终端发送的获取银行卡数据的请求；第二终端向第一终端发送银行卡数据。本申请实施例所述的第一终端通过与第二终端点对点无线通信连接，第二终端为第一终端提供相关银行卡账户信息的备份数据，从而第一终端利用备份数据将实体银行卡绑定到第一终端生成虚拟银行卡，无需用户在第一终端通过非自动化的方式(拍照、NFC读取或手工输入)输入银行卡账户信息开卡，简化了用户操作步骤，有效地提高了用户体验。
结合上述可能的实现方式，在另一种可能的实现方式中，第二终端包括TEE和SE，在第二终端建立与第一终端的点对点无线通信连接之前，方法还包括：第二终端接收添加银行卡的请求；第二终端根据添加银行卡的请求获取银行卡账户信息图像；第二终端根据图像处理算法对银行卡账户信息图像进行图像加密处理，得到第一加密银行卡数据；第二终端利用第二终端的公钥对第一加密银行卡数据进行加密，得到第二加密银行卡数据；第二终端对第二加密银行卡数据设置访问密码，得到第一备份数据；第二终端将第一备份数据保存于TEE，将图像处理算法的标识和图像处理算法使用的参数保存于eSE。从而，第二终端通过三层加密将银行卡账户信息图像进行加密后，将第一备份数据保存于TEE，将图像处理算法的标识和图像处理算法使用的参数保存于eSE，提高保存备份数据的安全性。
结合上述可能的实现方式，在另一种可能的实现方式中，第二终端包括TEE，在第二终端建立与第一终端的点对点无线通信连接之前，方法还包括：第二终端接收添加银行卡的请求；第二终端根据添加银行卡的请求获取迁移数据，迁移数据包括PAN后四位和BIN；第二终端根据第二终端的公钥加密迁移数据，得到第二备份数据；第二终端将第二备份数据保存于TEE；第二终端向第一服务器发送缓存请求，缓存请求包括PAN后四位和第二终端证书，缓存请求用于请求第一服务器将与PAN后四位相关的银行卡账户信息与第二终端证书关联。从而，第二终端对PAN后四位和BIN进行加密后，将第二备份数据保存于TEE，提高保存备份数据的安全性。并且，第一服务器预先存储有与PAN后四位相关的银行卡账户信息，进一步地提高第一终端获取与PAN后四位相关的银行卡账户信息的安全性。
结合上述可能的实现方式，在另一种可能的实现方式中，接收第一终端发送的获取银行卡数据的请求，具体包括：接收第一终端发送的验证凭据和第一终端证书，验证凭据包含业务凭据和身份凭据，第一终端证书是预置在第一终端的TEE中的终端证书，业务凭据用于证明第一终端获取银行卡数据的业务合法，身份凭据用于证明第一终端中登陆的账号合法。
结合上述可能的实现方式，在另一种可能的实现方式中，在第二终端接收第一终端发送的获取银行卡数据的请求之后，方法还包括：第二终端验证业务凭据、身份凭据和第一终端证书；若第二终端验证业务凭据、身份凭据和第一终端证书成功，则第二终端生成第一加密数据，第一加密数据包括通过第二终端的私钥签名和第一 终端的公钥加密的第一加密银行卡数据、图像处理算法的标识和图像处理算法使用的参数，第一加密银行卡数据包括银行卡账户信息图像，银行卡账户信息图像包括银行卡账户信息，银行卡账户信息用于标识银行卡；或者，第二终端生成第二加密数据，第二加密数据包括通过第二终端的私钥签名和第一终端的公钥加密的迁移数据，迁移数据包括PAN后四位和BIN。从而，通过公钥和私钥对第一终端和第二终端传输的银行卡数据进行加密和解密，获取银行卡账户信息，有效地提高获取银行卡数据的安全性。
结合上述可能的实现方式，在另一种可能的实现方式中，第二终端验证业务凭据、身份凭据和第一终端证书，具体包括：第二终端获取第一服务器证书和第二服务器证书；第二终端根据第一服务器证书验证业务凭据，并根据第二服务器证书验证身份凭据；第二终端通过认证中心根证书验证第一终端证书。本发明实施例提供了验证业务凭据、身份凭据和第一终端证书的具体实施方式，从而，有效地提高获取银行卡数据的安全性。
结合上述可能的实现方式，在另一种可能的实现方式中，第二终端向第一终端发送银行卡数据，银行卡数据包括第一加密数据或第二加密数据。本发明实施例提供了银行卡数据的具体实现方式。
结合上述可能的实现方式，在另一种可能的实现方式中，在第二终端向第一终端发送的银行卡数据包括第二加密数据的情况下，在第二终端向第一终端发送银行卡数据之后，方法还包括：第二终端向第一服务器发送第一终端证书，使第一服务器将第一终端证书与银行卡账户信息关联。这样，当第一终端向第一服务器发送请求获取银行卡账户信息时，第一服务器可利用第二终端提供的第一终端证书检查第一终端的身份，即比对请求获取银行卡账户信息的终端的证书与第二终端发送的证书是否一致。
本发明实施例的第三方面，提供一种第一终端，第一终端中具体受保护的运行环境，受保护的运行环境是可信执行环境TEE或安全单元SE，包括：接收单元，用于接收添加银行卡的请求；连接单元，用于建立与第二终端的点对点无线通信连接；发送单元，用于向第二终端发送获取银行卡数据的请求；接收单元，还用于接收第二终端发送的银行卡数据；处理单元，用于根据银行卡数据获取银行卡账户信息；发送单元，还用于向第一服务器发送开卡请求，从而在第一终端中添加银行卡，开卡请求包括银行卡账户信息。
本发明实施例的第四方面，提供一种第二终端，应用于具有受保护的运行环境的第二终端中，包括：连接单元，用于建立与第一终端的点对点无线通信连接；接收单元，用于接收第一终端发送的获取银行卡数据的请求；发送单元，用于向第一终端发送银行卡数据。
需要说明的是，上述第三方面和第四方面功能模块可以通过硬件实现，也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的模块。例如，收发器，用于完成接收单元和发送单元的功能，处理器，用于完成处理单元的功能，存储器，用于处理器处理本申请实施例的添加银行卡的方法的程序指令。处理器、收发器和存储器通过总线连接并完成相互间的通信。具体的，可以参 考第一方面提供的添加银行卡的方法中第一终端的行为的功能，以及第二方面提供的添加银行卡的方法中第二终端的行为的功能。
第五方面，本申请实施例提供一种第一终端，包括：处理器、存储器、总线和通信接口；该存储器用于存储计算机执行指令，该处理器与该存储器通过该总线连接，当该第一终端运行时，该处理器执行该存储器存储的该计算机执行指令，以使该第一终端执行如上述任意方面的方法。
第六方面，本申请实施例提供一种第二终端，包括：处理器、存储器、总线和通信接口；该存储器用于存储计算机执行指令，该处理器与该存储器通过该总线连接，当该第二终端运行时，该处理器执行该存储器存储的该计算机执行指令，以使该第二终端执行如上述任意方面的方法。
第七方面，本申请实施例提供了一种计算机可读存储介质，用于储存为上述第一终端所用的计算机软件指令，当其在计算机上运行时，使得计算机可以执行上述中任意方面的方法。
第八方面，本申请实施例提供了一种计算机可读存储介质，用于储存为上述第二终端所用的计算机软件指令，当其在计算机上运行时，使得计算机可以执行上述中任意方面的方法。
第九方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述任意方面的方法。
另外，第三方面至第九方面中任一种设计方式所带来的技术效果可参见第一方面至第二方面中不同设计方式所带来的技术效果，此处不再赘述。
本申请实施例中，第一终端、第二终端、第一服务器和第二服务器的名字对设备本身不构成限定，在实际实现中，这些设备可以以其他名称出现。只要各个设备的功能和本申请实施例类似，属于本申请权利要求及其等同技术的范围之内。
本申请实施例的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
图1为现有技术提供的实体银行卡绑定到终端生成虚拟银行卡的过程示意图；
图2为本发明实施例提供的系统架构的简化示意图；
图3为本发明实施例提供的服务器的组成示意图；
图4为本发明实施例提供的终端的组成示意图；
图5为本发明实施例提供的一种添加银行卡的方法流程图；
图6为本发明实施例提供的第一终端的界面显示示意图；
图7为本发明实施例提供的一种添加银行卡的方法流程图；
图8为本发明实施例提供的第一终端的界面显示示意图；
图9为本发明实施例提供的一种添加银行卡的方法流程图；
图10为本发明实施例提供的一种添加银行卡的方法流程图；
图11为本发明实施例提供的一种第一终端的结构示意图；
图12为本发明实施例提供的一种第一终端的结构示意图；
图13为本发明实施例提供的一种第二终端的结构示意图；
图14为本发明实施例提供的一种第二终端的结构示意图。
具体实施方式
本发明实施例提供一种添加银行卡的方法，银行卡可以是信用卡(credit card)或借记卡(debit card)，其基本原理是：通常具有NFC支付功能的终端绝大部分都支持受保护的运行环境，例如TEE和/或eSE。当用户需要将实体银行卡绑定到第一终端生成虚拟银行卡时，首选地，第一终端建立与第二终端的点对点无线通信连接(例如，蓝牙(Bluetooth，BT)连接，或NFC点对点连接，或NFC连接，或Wi-Fi点对点(Wi-Fi Peer to Peer，Wi-Fi P2P)连接等)，然后，第二终端验证第一终端身份后，将备份数据发给第一终端，第一终端根据得到的备份数据在其受保护的运行环境中获取银行卡账户信息，再利用获取的银行卡账户信息生成开卡请求，最终在第一终端上成功开卡即将第一服务器返回的虚拟银行卡安装到第一终端的eSE中。需要说明的是，在用户首次在第二终端上将实体银行卡绑定到第二终端生成虚拟银行卡后，经用户许可和/或认证，在第二终端中生成备份数据，利用第二终端的受保护的运行环境中的安全硬件(例如，TEE的可信存储空间，或eSE的存储空间)保存备份数据。从而，本申请实施例所述的第一终端通过与第二终端点对点无线通信连接，从第二终端获取相关银行卡账户信息的备份数据，利用备份数据将实体银行卡绑定到第一终端生成虚拟银行卡，无需用户在第一终端通过非自动化的方式(拍照、NFC读取或手工输入)输入银行卡账户信息(PAN和有效期、CVV等，可能还包括银行卡预留到银行的手机号等)开卡，简化了用户操作步骤，有效地提高了用户体验。
下面将结合附图对本发明实施例的实施方式进行详细描述。
图2示出的是可以应用本发明实施例的系统架构的简化示意图。如图2所示，该系统架构可以包括：第一终端11、第二终端12、第一服务器13、第二服务器14和无线通信网络15。
其中，第一终端11和第二终端12是指向用户提供语音和/或数据连通性的设备(device)。例如，手机、平板电脑、笔记本电脑、超级移动个人计算机(Ultra-mobile Personal Computer，UMPC)、上网本、个人数字助理(Personal Digital Assistant，PDA)等等。作为一种实施例，如图2中所示，本发明的系统架构包括的第一终端11和第二终端12为手机。第一终端和第二终端通过无线通信技术与第一服务器和第二服务器进行通信。第二终端与第一终端可以通过点对点无线通信连接进行通信。
第一服务器13即令牌服务提供者(Token Service Provider，TSP),一般由银联或Visa、Mastercard等卡组织实现，也可以由发卡方如银行实现和提供服务；在系统中，接收终端发送的开卡请求即令牌服务请求，并向终端发送虚拟银行卡数据，包括令牌(即本申请实施例中安装于eSE中的虚拟银行卡的虚拟卡号)和令牌相关数据，如卡片密钥等，卡片密钥用于向交易受理终端(如，PoS机)证明卡片是合法的；此外，TSP还提供业务序号和业务凭据；
第二服务器14是指支付应用对应的服务器，如各大手机厂商提供的钱包服务对应的服务器，还可以是各大手机厂商提供的云服务器(提供的云服务包含钱包服务)；用户在终端上输入用户名和验证信息后可登陆到第二服务器，通过第二服务器可对支付应用(即钱包)的状态进行管理，如锁定钱包、擦除钱包数据等；本申请实施 例中，第二服务器还可为终端提供身份凭据，证明钱包应用成功登录了经服务器验证的账号。
无线通信网络15，是一种提供无线通信功能的网络。无线通信网络可以采用不同的通信技术，例如码分多址(code division multiple access，CDMA)、宽带码分多址(wideband code division multiple access，WCDMA)、时分多址(time division multiple access，TDMA)、频分多址(frequency division multiple access，FDMA)、正交频分多址(orthogonal frequency-division multiple access，OFDMA)、单载波频分多址(single carrier FDMA，SC-FDMA)、载波侦听多路访问/冲突避免(carrier sense multiple access with collision avoidance)。根据不同网络的容量、速率、时延等因素可以将网络分为2G(generation)网络、3G网络或者4G网络。典型的2G网络包括全球移动通信系统(global system for mobile communications/general packet radio service，GSM)网络或者通用分组无线业务(general packet radio service，GPRS)网络，典型的3G网络包括通用移动通信系统(universal mobile telecommunications system，UMTS)网络，典型的4G网络包括长期演进(long term evolution，LTE)网络。其中，UMTS网络有时也可以称为通用陆地无线接入网(universal terrestrial radio access network，UTRAN)，LTE网络有时也可以称为演进型通用陆地无线接入网(evolved universal terrestrial radio access network，E-UTRAN)。根据资源分配方式的不同，可以分为蜂窝通信网络和无线局域网络(wireless local area networks，WLAN)，其中，蜂窝通信网络为调度主导，WLAN为竞争主导。前述的2G、3G和4G网络，均为蜂窝通信网络。本领域技术人员应知，随着技术的发展本发明实施例提供的技术方案同样可以应用于其他的无线通信网络，例如4.5G或者5G网络，或其他非蜂窝通信网络。为了简洁，本发明实施例有时会将无线通信网络英文缩写为网络。
图3为本发明实施例提供的一种服务器的组成示意图，图2中的第一服务器13和第二服务器14可以以图3中的服务器的方式来实现。如图3所示，服务器可以包括至少一个处理器21，存储器22、通信接口23、通信总线24。
下面结合图3对服务器的各个构成部件进行具体的介绍：
处理器21是服务器的控制中心，可以是一个处理器，也可以是多个处理元件的统称。例如，处理器21是一个中央处理器(Central Processing Unit，CPU)，也可以是特定集成电路(Application Specific Integrated Circuit，ASIC)，或者是被配置成实施本发明实施例的一个或多个集成电路，例如：一个或多个微处理器(Digital Signal Processor，DSP)，或，一个或者多个现场可编程门阵列(Field Programmable Gate Array，FPGA)。
其中，处理器21可以通过运行或执行存储在存储器22内的软件程序，以及调用存储在存储器22内的数据，执行服务器的各种功能。
在具体的实现中，作为一种实施例，处理器21可以包括一个或多个CPU，例如图3中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，服务器可以包括多个处理器，例如图3中所示的处理器21和处理器25。这些处理器中的每一个可以是一个单核处理器 (single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
存储器22可以是只读存储器(Read-only Memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(Random Access Memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器22可以是独立存在，通过通信总线24与处理器21相连接。存储器22也可以和处理器21集成在一起。
其中，存储器22用于存储执行本发明方案的软件程序，并由处理器21来控制执行。
通信接口23，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(Wireless Local Area Networks，WLAN)等。通信接口23可以包括接收单元实现接收功能，以及发送单元实现发送功能。
通信总线24，可以是工业标准体系结构(Industry Standard Architecture，ISA)总线、外部设备互连(Peripheral Component，PCI)总线或扩展工业标准体系结构(Extended Industry Standard Architecture，EISA)总线等。该总线可以分为地址总线、数据总线、控制总线等。为便于表示，图3中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
图3中示出的设备结构并不构成对服务器的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
图4为本发明实施例提供的一种终端的组成示意图，图2中的第一终端11和第二终端12可以以图4中的终端的方式来实现。如图4所示，终端可以包括至少一个处理器31、存储器32、显示器33、收发器34。
下面结合图4对终端的各个构成部件进行具体的介绍：
处理器31是终端的控制中心，可以是一个处理器，也可以是多个处理元件的统称。例如，处理器31是一个CPU，也可以是ASIC，或者是被配置成实施本发明实施例的一个或多个集成电路，例如：一个或多个DSP，或，一个或者多个FPGA。其中，处理器31可以通过运行或执行存储在存储器32内的软件程序，以及调用存储在存储器32内的数据，执行终端的各种功能。本申请实施例所述的处理器31是在TEE环境下运行。
在具体的实现中，作为一种实施例，处理器31可以包括一个或多个CPU，例如图4中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，终端可以包括多个处理器，例如图4中所示的处理器31和处理器35。这些处理器中的每一个可以是一个single-CPU处理器， 也可以是一个multi-CPU处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
存储器32可以是ROM或可存储静态信息和指令的其他类型的静态存储设备，RAM或者可存储信息和指令的其他类型的动态存储设备，也可以是EEPROM、CD-ROM或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器32可以是独立存在，通过通信总线34与处理器31相连接。存储器32也可以和处理器31集成在一起。其中，所述存储器32用于存储执行本发明方案的软件程序，并由处理器31来控制执行。本申请实施例所述的存储器32是在TEE环境下的存储器。
显示器33可用于显示由用户输入的信息或提供给用户的信息以及终端的各种菜单。显示器33可包括显示屏幕331，可选的，可以采用液晶显示器(Liquid Crystal Display，LCD)、有机发光二极管(Organic Light-Emitting Diode，OLED)等形式来配置显示屏幕331。
收发器34，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，RAN，WLAN等。收发器34可以包括接收单元实现接收功能，以及发送单元实现发送功能。
图4中示出的设备结构并不构成对终端的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。尽管未示出，终端还可以包括电池、摄像头、蓝牙模块、全球定位系统(Global Positioning System，GPS)模块、NFC模块、SE模块等，在此不再赘述。
在本发明实施例中，对于第一终端，各个模块的具体作用如下：
收发器34，用于接收添加银行卡的请求。显示器33，用于在第一终端的显示屏幕上至少显示第一选项和第二选项，其中，第一选项为输入银行卡号或扫描银行卡或贴卡读号，第二选项为从其他终端获取银行卡数据。显示器33，还用于在第二选项下方显示至少一个其他终端的标识；或，在第一终端接收了用户对第二选项的选择后，显示至少一个其他终端的标识；其中，其他终端包括第二终端，其他终端与第一终端使用同一账号(同一支付应用账号，或同一云服务账号)登陆。处理器31，用于建立与第二终端的点对点无线通信连接；收发器34，还用于向第二终端发送获取银行卡数据的请求；收发器34，还用于接收第二终端发送的银行卡数据；处理器31，用于在受保护的运行环境中根据银行卡数据获取银行卡账户信息，受保护的运行环境可以是TEE或SE；收发器34，还用于向第一服务器发送开卡请求，从而在第一终端中添加银行卡，开卡请求包括银行卡账户信息。
收发器34，具体用于通过点对点无线通信连接向第二终端发送验证凭据和/或第一终端证书；其中，验证凭据包含业务凭据和身份凭据，第一终端证书是预置在第一终端的受保护的运行环境中的终端证书，业务凭据用于证明第一终端获取银行卡数据的业务合法，身份凭据用于证明第一终端中登陆的账号合法。
收发器34，具体用于接收第二终端发送的第一加密数据，其中，第一加密数据 包括通过第二终端的私钥签名和第一终端的公钥加密的第一加密银行卡数据、图像处理算法的标识和图像处理算法使用的参数，第一加密银行卡数据包括银行卡账户信息图像，银行卡账户信息图像包括银行卡账户信息，银行卡账户信息用于标识银行卡；或，第一终端接收第二终端发送的第二加密数据，其中，第二加密数据包括通过第二终端的私钥签名和第一终端的公钥加密的迁移数据，迁移数据包括PAN后四位和BIN。
处理器31，具体用于第一终端在该第一终端的TEE中利用第二终端的公钥验证第二终端的私钥签名，并利用第一终端的私钥解密第一加密数据，得到第一加密银行卡数据、图像处理算法的标识和图像处理算法使用的参数；第一终端在该第一终端的TEE中根据与图像处理算法的标识对应的图像处理算法和图像处理算法使用的参数，解密第一加密银行卡数据，得到银行卡账户信息图像；第一终端在该第一终端的TEE中利用OCR识别银行卡账户信息图像，得到银行卡账户信息。
处理器31，具体用于第一终端在该第一终端的TEE中利用第二终端的公钥验证第二终端的私钥签名，并利用第一终端的私钥解密第二加密数据，得到迁移数据；第一终端向第一服务器发送第一终端证书、迁移数据和第二终端对迁移数据的签名；第一终端接收第一服务器发送的银行卡账户信息。
收发器34，还用于第一终端从第一服务器获取业务凭据，业务凭据包括业务序号和第一服务器对业务序号的签名；存储器32，用于在该第一终端的TEE中保存业务凭据。
收发器34，还用于使用与第二终端相同的账号向第二服务器发送业务序号；
收发器34，还用于接收第二服务器发送的身份凭据，身份凭据包括业务序号和第二服务器对业务序号的签名；
存储器32，还用于在该第一终端的TEE中保存身份凭据。
收发器34，还用于向第一服务器发送第一注销消息，第一注销消息用于指示第一服务器注销业务凭据；或/和，向第二服务器发送第二注销消息，第二注销消息用于指示第二服务器注销身份凭据。
在本发明实施例中，对于第二终端，各个模块的具体作用如下：
收发器34，用于接收第一终端发送的获取银行卡数据的请求；收发器34，还用于向第一终端发送银行卡数据。
收发器34，还用于接收添加银行卡的请求；处理器31，还用于根据添加银行卡的请求获取银行卡账户信息图像；处理器31，还用于根据图像处理算法对银行卡账户信息图像进行图像加密处理，得到第一加密银行卡数据；处理器31，还用于利用第二终端的公钥对第一加密银行卡数据进行加密，得到第二加密银行卡数据；处理器31，还用于对第二加密银行卡数据设置访问密码，得到第一备份数据；存储器32，用于将第一备份数据保存于第二终端的TEE，将图像处理算法的标识和图像处理算法使用的参数保存于eSE。
收发器34，还用于接收添加银行卡的请求；处理器31，还用于根据添加银行卡的请求获取迁移数据，迁移数据包括PAN后四位和BIN；处理器31，还用于根据第二终端的公钥加密迁移数据，得到第二备份数据；存储器32，还用于将第二备份数 据保存于第二终端的TEE；收发器34，还用于向第一服务器发送缓存请求，缓存请求包括PAN后四位和第二终端证书，缓存请求用于请求第一服务器将与PAN后四位相关的银行卡账户信息与第二终端证书关联。
图5为本发明实施例提供的一种添加银行卡的方法流程图，该方法应用于具有TEE的第一终端，如图5所示，该方法具体包括：
401、第一终端接收添加银行卡的请求。
首先，用户开启第一终端的NFC功能，无线和网络设置界面内点击“NFC”进入控制界面，进入NFC控制界面后，打开NFC功能，同时，打开NFC的内置安全芯片功能；然后，用户在第一终端的主屏幕点击支付应用图标，登录支付应用的账号，进入支付应用用户界面，用户点击“卡包”，进入添加卡片界面，用户点击“添加”，第一终端的显示屏幕上提示需要添加卡片的类型选项，用户选择添加银行卡(信用卡或借记卡)，第一终端接收到添加银行卡的请求。
在第一终端接收到添加银行卡的请求之后，第一终端在第一终端的显示屏幕上至少显示第一选项和第二选项，其中，第一选项为输入银行卡号、扫描银行卡或贴卡读号，第二选项为从其他终端获取银行卡数据。示例的，图6为本申请实施例提供的一种第一终端的界面显示示意图，第一终端的显示屏幕上显示第一选项和第二选项，用户可以根据自己的需要进行选择。如果用户是第一次在第一终端上添加银行卡，可以选择第一选项；如果用户以前在其他终端上添加过银行卡，那么，用户可以选择第二选项，从其他终端获取银行卡数据。进一步的，在第二选项下方显示至少一个其他终端的标识。
可选的，在第一终端接收了用户对第二选项的选择后，第一终端再显示至少一个其他终端的标识；其中，其他终端包括第二终端，其他终端与第一终端使用同一支付应用账号或同一云服务账号登陆。第一终端可以用可信用户界面(Trusted User Interface，TUI)呈现第一选项和第二选项，以及第一选项和第二选项对应的输入界面。
402、第一终端建立与第二终端的点对点无线通信连接。
在第一终端接收到添加银行卡的请求，用户选择通过其他终端添加银行卡的选项后，第一终端建立与第二终端的点对点无线通信连接。
403、第一终端向第二终端发送获取银行卡数据的请求。
第一终端建立与第二终端的点对点无线通信连接之后，第一终端向第二终端发送获取银行卡数据的请求。
需要说明的是，在第一终端向第二终端发送获取银行卡数据的请求之前，第一终端可以先获取验证凭据和第一终端证书，验证凭据可以包括业务凭据和身份凭据。示例的，首先，第一终端从第一服务器获取业务凭据，业务凭据包括业务序号和第一服务器对业务序号的签名，业务凭据用于证明第一终端获取银行卡数据的业务合法；然后，第一终端使用与第二终端相同的账号向第二服务器发送业务序号，第一终端接收第二服务器发送的身份凭据，身份凭据包括业务序号和第二服务器对业务序号的签名，身份凭据用于证明第一终端中登陆的账号合法。第一终端在该第一终端的TEE中保存身份凭据。第一终端在该第一终端的TEE中保存业务凭据。第一终 端证书是预置在第一终端的TEE中的终端证书。获取银行卡数据的请求包括验证凭据和/或第一终端证书。
404、第二终端接收第一终端发送的获取银行卡数据的请求。
第一终端向第二终端发送获取银行卡数据的请求之后，第二终端接收第一终端发送的获取银行卡数据的请求。
405、第二终端向第一终端发送银行卡数据。
第二终端接收到第一终端发送的获取银行卡数据的请求之后，第二终端向第一终端发送银行卡数据。
需要说明的是，在第二终端向第一终端发送银行卡数据之前，第二终端需要验证验证凭据和/或第一终端证书。若第二终端验证验证凭据和/或第一终端证书成功，第二终端生成第一加密数据或第二加密数据，第一加密数据包括通过第二终端的私钥签名和第一终端的公钥加密的第一加密银行卡数据、图像处理算法的标识和图像处理算法使用的参数，第一加密银行卡数据包括一张或多张由用户选中的银行卡账户信息图像，银行卡账户信息图像包括银行卡账户信息，银行卡账户信息用于标识银行卡；第二加密数据包括通过第二终端的私钥签名和第一终端的公钥加密的迁移数据，迁移数据包括至少一张银行卡的PAN后四位和BIN。BIN用于识别银行。进一步的，在第二终端向第一终端发送银行卡数据之前，可提供用户界面提示用户选择第二终端上已经绑定的一张或多张银行卡进行迁移，并接收用户选择。银行卡数据第一加密数据或第二加密数据。
406、第一终端接收第二终端发送的银行卡数据。
第二终端向第一终端发送银行卡数据之后，第一终端接收第二终端发送的银行卡数据。
407、第一终端根据银行卡数据获取银行卡账户信息。
第一终端接收第二终端发送的银行卡数据之后，在银行卡数据包括第一加密数据的情况下，第一终端在受保护的运行环境中，如在TEE中利用第二终端的公钥验证第二终端的私钥签名，并利用第一终端的私钥解密第一加密数据，得到第一加密银行卡数据、图像处理算法的标识和图像处理算法使用的参数；第一终端在该第一终端的TEE中根据与图像处理算法的标识对应的图像处理算法和图像处理算法使用的参数，解密第一加密银行卡数据，得到银行卡账户信息图像，第一终端利用OCR算法处理银行卡账户信息图像，得到银行卡账户信息。
第一终端接收第二终端发送的银行卡数据之后，在银行卡数据包括第二加密数据的情况下，第一终端在受保护的运行环境中利用第二终端的公钥验证第二终端的私钥签名，并利用第一终端的私钥解密第二加密数据，得到迁移数据；第一终端向第一服务器发送第一终端证书、迁移数据和第二终端对迁移数据的签名；第一终端接收第一服务器发送的银行卡账户信息。
408、第一终端向第一服务器发送开卡请求，从而在第一终端中添加银行卡。
在第一终端根据银行卡数据获取到银行卡账户信息后，第一终端向第一服务器发送开卡请求，从而在第一终端中添加所述银行卡，开卡请求包括银行卡账户信息。
从而，本申请实施例所述的第一终端通过与第二终端点对点无线通信连接，从 第二终端获取相关银行卡账户信息的银行卡数据，利用银行卡数据将实体银行卡绑定到第一终端生成虚拟银行卡，无需用户在第一终端通过非自动化的方式输入银行卡账户信息开卡，简化了用户操作步骤，有效地提高了用户体验。
图7为本发明实施例提供的一种添加银行卡的方法流程图，其对图5所述的银行卡数据包括第一加密数据的情况进行细化，其中，假设第一终端为目标终端即尚未开通虚拟银行卡的终端，第二终端为原终端即已经开通数张虚拟银行卡的终端，原终端预先存储第一备份数据，目标终端从原终端获取第一备份数据，如图7所示，该方法具体包括以下步骤：
501、原终端接收第一添加银行卡请求。
具体的可以参考步骤401所述的详细叙述，在此不再赘述。第一添加银行卡请求用于指示在支付应用中添加一个银行卡，用户根据引导填充信息可完成添加银行卡并在终端中生成一张虚拟银行卡的操作。
502、原终端根据第一添加银行卡请求获取银行卡账户信息图像。
原终端接收到第一添加银行卡请求之后，原终端根据第一添加银行卡请求获取银行卡账户信息图像。银行卡账户信息图像包括实体银行卡正面图像，或者实体银行卡正面图像和实体银行卡反面图像，实体银行卡正面图像和实体银行卡反面图像都包含银行卡账户信息。示例的，对于信用卡，实体银行卡正面图像包括主卡号和有效期的影像，实体银行卡反面图像包括CVV的影像，此场景下，原终端需要获取实体银行卡正面图像和实体银行卡反面图像，原终端获取的银行卡账户信息图像包括实体银行卡正面图像和实体银行卡反面图像。对于储蓄卡，实体银行卡正面图像包括主卡号的影像，此场景下，原终端只需要获取实体银行卡正面图像，原终端获取的银行卡账户信息图像包括实体银行卡正面图像。
原终端可以通过用户界面(User Interface，UI)显示“扫描输入”、“贴卡读号”和“手动输入”来提示用户，用户自己选择采用“扫描输入”、“贴卡读号”或“手动输入”，使原终端获取银行卡账户信息。本申请实施例中，优选地采用扫描输入的方式获得银行卡账户信息；
具体的，原终端接收到扫描输入请求后启动TEE控制的摄像头驱动，开启终端的摄像头，通过摄像头扫描实体银行卡正面和实体银行卡反面。需要说明的是，若原终端未设置“扫描输入”和“手动输入”提示功能，直接设置采用扫描实体银行卡来获取银行卡账户信息图像时，原终端接收到第一添加银行卡请求后直接启动TEE控制的摄像头驱动，开启终端的摄像头，通过摄像头扫描实体银行卡正面和实体银行卡反面。然后，原终端启动OCR算法，利用OCR算法识别实体银行卡正面图像和实体银行卡反面图像，得到主卡号等银行卡账户信息，将银行卡账户信息通过TUI呈现给用户，并可以提示用户确认银行卡账户信息是否正确以及是否保存，如果银行卡账户信息正确，用户可以在用户界面点击“确认”和/或“保存”。需要说明的是，TUI从视觉效果上可以与图1所示一致，但是不同点在于TUI依赖于TEE提供的软件环境实现，现有技术图1填写银行卡的界面是图形用户界面(Graphical User Interface，GUI)，是非可信环境提供的界面。
原终端还可以通过用户在填写银行卡账户信息用户界面上手动输入的主卡号， 或者通过贴卡读号等方式，来获取银行卡账户信息，原终端可将获取到的银行卡账户信息转换为图片，得到银行卡账户信息图像。需要说明的是，可以采用一个预设的算法，比如预设一个背景具有颜色和纹理的、固定大小的图片，将银行卡账户信息进行处理后显示在预设图片之上，然后合成为一个包含数字信息的图像，即银行卡账户信息图像。
503、原终端在受保护的运行环境中，根据图像处理算法对银行卡账户信息图像进行图像加密处理，得到第一加密银行卡数据。
原终端根据第一添加银行卡请求获取到银行卡账户信息图像之后，根据图像处理算法对银行卡账户信息图像进行图像加密处理，得到第一加密银行卡数据。原终端根据图像处理算法对银行卡账户信息图像进行图像加密处理，从而使人眼或OCR算法无法识别出实体银行卡正面图像和实体银行卡反面图像呈现的银行卡账户信息，例如，主卡号、有效期和信用卡安全码等等。需要说明的是，图像处理算法可以是随机打乱各行进行数字图像加密，随机打乱各列进行数字图像加密；同时打乱各行各列进行加密；随机打乱像素点进行加密；利用混沌序列进行数字图像加密等。上述数字处理算法参考《图像加密算法与实践》一书(标准书号：978-7-03-037670-1)实现。加密过程中，可通过TUI显示输入界面，令用户输入或选择一个加密参数。
504、原终端在受保护的运行环境中，利用原终端的公钥对第一加密银行卡数据进行加密，得到第二加密银行卡数据。
原终端根据图像处理算法对银行卡账户信息图像进行图像加密处理，得到第一加密银行卡数据之后，再利用原终端的公钥对第一加密银行卡数据进行加密，得到第二加密银行卡数据。
需要说明的是，公钥(Public Key)与私钥(Private Key)是通过一种算法得到的一个密钥对，即一个公钥和一个私钥。公钥是密钥对中公开的部分，私钥则是非公开的部分。公钥通常用于加密会话密钥、验证数字签名，或加密可以用相应的私钥解密的数据。通过这种算法得到的密钥对能保证在世界范围内是唯一的。使用这个密钥对的时候，如果用其中一个密钥加密一段数据，必须用另一个密钥解密。比如用公钥加密数据就必须用私钥解密，如果用私钥加密也必须用公钥解密，否则解密将不会成功。原终端的公钥是指保存于原终端受保护的运行环境(如TEE的可信存储)中的终端证书所包含的公钥。利用该公钥加密的数据只有利用其对应的私钥才可以解密，而私钥只有原终端掌握；因此，原终端利用公钥加密的数据，其他实体即使获取到也会因缺少原终端的私钥而无法解密。
505、原终端对第二加密银行卡数据设置访问密码，得到第一备份数据。
原终端利用原终端的公钥对第一加密银行卡数据进行加密，得到第二加密银行卡数据之后，对第二加密银行卡数据设置访问密码，得到第一备份数据。原终端对第二加密银行卡数据设置的访问密码可以是个人识别码(Personal Identification Number，PIN)或者指纹。第一备份数据为经过图像处理算法、原终端的公钥和访问密码三层加密的银行卡账户信息图像。
506、原终端将第一备份数据保存于原终端的TEE的可信存储中，并将图像处理算法的标识和图像处理算法使用的参数保存于原终端的eSE中。
原终端对第二加密银行卡数据设置访问密码，得到第一备份数据之后，将第一备份数据保存于原终端的TEE的可信存储中，并将图像处理算法的标识和图像处理算法使用的参数保存于原终端的eSE中。可选的，当原终端获取到银行卡账户信息，向第一服务器请求激活银行卡，第一服务器对持卡人进行验证时，需要用户输入关联到银行卡的手机号码，此时可以将这个输入的手机号利用原终端的公钥加密后保存于TEE中。需要说明的是，对于手机号码，可以采用转换为图片后保存于TEE中，也可以直接加密保存于TEE中。
可选的，当原终端利用扫描卡片方式获取银行卡账户信息时，可以将实体银行卡反面图像先经图像处理算法处理，然后利用原终端的公钥加密，之后保存于eSE中，并设置PIN或指纹访问密码，得到第一备份数据。这样，第一备份数据可以包括加密后保存于TEE中的实体银行卡正面图像和加密后保存于eSE中的实体银行卡反面图像。因实体银行卡反面图像包含CVV，因此利用eSE保存可以进一步提升安全，防止数据被窃取带来的风险。
从而，原终端能够安全地获取银行卡账户信息，并将包括银行卡账户信息的第一备份数据保存于原终端的TEE，或TEE和eSE中，将图像处理算法的标识和图像处理算法使用的参数保存于eSE，使得原终端能够安全地存储第一备份数据。即使第一备份数据被导出，也会因为缺少解密密钥而无法恢复其中信息。步骤501-506公开了一种NFC支付应用备份银行卡数据的方法，可单独作为备份流程执行，也可作为一个完整的添加银行卡的过程的一部分执行，本发明实施例不做限定。
507、目标终端接收第二添加银行卡请求。
具体的可以参考步骤401所述的详细叙述，在此不再赘述。
508、目标终端向第一服务器发送第二添加银行卡请求。
目标终端接收到第二添加银行卡请求之后，向第一服务器发送第二添加银行卡请求，以便第一服务器为目标终端生成业务序号和业务凭据，业务凭据包括业务序号和第一服务器对业务序号的签名。第二添加银行卡请求包含目标终端证书。业务凭据用于证明目标终端获取银行卡数据的业务合法。
509、第一服务器接收到第二添加银行卡请求后，验证目标终端身份。
第一服务器可从第二添加银行卡请求中获得目标终端证书，此后，可通过认证中心根证书验证目标终端证书。认证中心根证书可预置在第一服务器中，或者，第一服务器预置了可验证目标终端证书链的根证书。
需要说明的是，数字证书是由具有权威性、可信任性及公正性的第三方机构，即证书认证(Certificate Authority，CA)中心颁发给一个安全用户的证明，又称为“数字身份证”，是一种权威性的电子文档。证书的内容包括：发证机构信息、使用者信息、数字证书有效期、用户公钥和发证机构签名等。最简单的证书包含一个公开密钥、数字证书名称以及证书授权中心的数字签名。数字签名是指采用密码算法，对数据进行加密处理，将加密后的数据附加在原文后一起发送，这段信息类似于现实中的签名或印章，接收方能够对其进行验证。数字证书只在特定的时间段内有效。数字证书的作用是证明证书中列出的用户合法拥有证书中列出的公开密钥。数字证书颁发过程一般为：用户首先产生自己的密钥对，并将公共密钥及部分个人身份信 息传送给证书认证中心。证书认证中心在核实身份后，将执行一些必要的步骤，以确信请求确实由用户发送而来，然后，证书认证中心将发给用户一个数字证书，该证书内包含用户的个人信息和他的公钥信息，同时还附有证书认证中心的签名信息。用户就可以使用自己的数字证书进行相关的各种活动。数字证书由独立的证书发行机构发布。数字证书各不相同，每种证书可提供不同级别的可信度。目标终端证书，是由终端厂商预置到目标终端的TEE或eSE中的数字证书，其作用是标识该目标终端具有受保护的运行环境(TEE或eSE)；还可用于在特定的业务场景中向服务器标识终端的身份。目标终端证书由终端厂商向CA发送证书签发请求获得，包括目标终端的公钥以及证书认证中心对目标终端的公钥的数字签名。
第一服务器利用认证中心根证书验证目标终端的公钥的数字签名，若验证通过则第一服务器验证目标终端证书成功。执行步骤510。
510、第一服务器生成业务序号。
第一服务器验证目标终端的身份通过后，需要生成业务序号和业务凭据，以便后续业务的执行。业务序号(Service Number，SN)是第一服务器产生的，用于标识目标终端向第一服务器发送的添加银行卡请求业务的序号。业务序号为标识一笔业务的一个标识信息，标识特定终端执行的特定类型的业务。本申请实施例中业务序号用于标识目标终端利用备份数据恢复虚拟银行卡业务。业务序号还可被第一服务器和/或第二服务器保存到两部终端之间的数据迁移业务的日志中。
511、第一服务器用第一服务器的私钥签名业务序号，生成业务凭据。
第一服务器生成业务序号之后，第一服务器用第一服务器的私钥签名业务序号，生成业务凭据。业务凭据包括业务序号和第一服务器对业务序号的签名。目标终端可利用第一服务器证书验证业务凭据中的签名，以确保业务序号未被篡改。
512、第一服务器向目标终端发送业务凭据和第一服务器证书。
第一服务器用第一服务器私钥签名业务序号，生成业务凭据之后，向目标终端发送业务凭据和第一服务器证书，第一服务器证书用于验证业务凭据，确保业务序号未被篡改。
513、目标终端接收到业务凭据和第一服务器证书后，将业务凭据保存于目标终端的TEE中。
具体的，可保存于TEE的随机存取存储器(Random Access Memory，RAM)中，或非易失存储器中。
514、目标终端向第二服务器发送业务序号。
目标终端利用接收到的第一服务器证书对业务凭据解密，得到业务序号，向第二服务器发送业务序号。
515、第二服务器接收到业务序号后，用第二服务器的私钥签名业务序号，生成身份凭据。
身份凭据用于证明目标终端中登陆的账号合法，身份凭据包括业务序号和第二服务器对业务序号的签名。
516、第二服务器向目标终端发送身份凭据。
第二服务器接收到业务序号后，用第二服务器私钥签名业务序号，生成身份凭 据之后，向目标终端发送身份凭据。
517、目标终端接收到身份凭据后，将身份凭据保存于目标终端的TEE中。
具体的，可保存于TEE的内存RAM中，或非易失存储器中。步骤507-步骤517是目标终端获取验证凭据的流程，验证凭据包括业务凭据和身份凭据，其执行不受步骤501-506的限制。
518、目标终端建立与原终端的点对点无线通信连接。
目标终端可以通过BT、NFC或Wi-Fi P2P建立与原终端的点对点无线通信连接。
519、目标终端验证原终端证书。
在建立连接的过程中，目标终端接收原终端证书，通过认证中心根证书验证原终端证书。需要说明的是，步骤519是可选地，也可以直接执行步骤520。
若目标终端验证原终端证书成功，执行步骤520。
520、目标终端通过点对点无线通信连接向原终端发送获取银行卡数据的请求。
获取银行卡数据的请求包括验证凭据和目标终端证书，验证凭据包括业务凭据和身份凭据。可选的，获取银行卡数据的请求可以只包含验证凭据或只包含目标终端证书；
521、原终端接收到获取银行卡数据的请求后，验证业务凭据、身份凭据和目标终端证书。
具体的，原终端接收到目标终端发送的银行卡数据迁移请求后，从请求中获取业务凭据、身份凭据和目标终端证书，并进行验证；原终端可利用终端中预置的根证书或者连接终端认证中心服务器获取到的认证中心根证书，对目标终端证书进行验证，原终端可利用已经获得的第一服务器证书对业务凭据进行验证，原终端可利用已经获得的第二服务器证书对身份凭据进行验证；原终端还可以分别连接第一服务器和第二服务器，从第一服务器获取第一服务器证书，从第二服务器获取第二服务器证书，然后，利用第一服务器证书验证业务凭据，利用第二服务器证书验证身份凭据。
若原终端验证业务凭据、身份凭据和目标终端证书成功，执行步骤522。
进一步的，原终端验证业务凭据、身份凭据和目标终端证书成功后可以在用户界面提示用户验证成功。可选地，原终端可只验证验证凭据成功即执行步骤522，或者原终端可只验证目标终端证书成功即执行步骤522。
522、原终端在TEE中对第一备份数据进行解密，获取第一加密银行卡数据。
原终端验证业务凭据、身份凭据和目标终端证书成功后，利用访问密码对第一备份数据进行解密，获取到第二加密银行卡数据，再利用原终端的私钥对第二加密银行卡数据进行解密，获取到第一加密银行卡数据。
可选地，原终端从eSE中获取加密的实体银行卡反面图像并在TEE中利用原终端的私钥解密，获得第一加密银行卡数据。
523、原终端在TEE中生成第一加密数据。
原终端利用目标终端的公钥对第一加密银行卡数据、图像处理算法的标识和图像处理算法使用的参数进行加密，并利用原终端的私钥对通过目标终端的公钥加密的第一加密银行卡数据、图像处理算法的标识和图像处理算法使用的参数进行签名， 得到第一加密数据。目标终端的公钥可以从目标终端证书中获取，目标终端证书包括目标终端的公钥。原终端在TEE中存储有原终端的私钥，即原终端的终端证书对应的私钥。
524、原终端通过点对点无线通信连接向目标终端发送第一加密数据。
原终端在TEE中生成第一加密数据之后，向目标终端发送第一加密数据。原终端通过点对点无线通信连接向目标终端发送银行卡数据迁移响应，银行卡数据迁移响应是原终端对目标终端发送的银行卡数据迁移请求的应答，包括第一加密数据，第一加密数据包括通过原终端的私钥签名和目标终端的公钥加密的第一加密银行卡数据、图像处理算法标识和图像处理算法使用的参数。
525、目标终端接收到第一加密数据后，在TEE中根据第一加密数据获取银行卡账户信息。
原终端通过点对点无线通信连接向目标终端发送第一加密数据之后，目标终端通过点对点无线通信连接接收第一加密数据。目标终端也可以接收原终端发送的银行卡数据迁移响应，目标终端从银行卡数据迁移响应中获取到第一加密数据。
目标终端通过点对点无线通信连接接收第一加密数据之后，根据第一加密数据获取银行卡账户信息。示例的，由于第一加密数据由原终端的私钥签名和目标终端的公钥加密，所以，目标终端接收到原终端发送的第一加密数据后，首选，利用原终端证书验证原终端的私钥签名，并利用目标终端的私钥解密第一加密数据，得到第一加密银行卡数据、图像处理算法的标识和图像处理算法使用的参数，然后，目标终端根据图像处理算法的标识和图像处理算法使用的参数，调用本地图像处理算法对第一加密银行卡数据进行解密处理，得到银行卡账户信息图像，即实体银行卡正面图像，或者实体银行卡正面图像和实体银行卡反面图像，目标终端可在用户界面显示待激活虚拟银行卡，如图8所示。然后，利用OCR算法处理银行卡账户信息图像，得到银行卡账户信息。
用户选中待激活虚拟银行卡，目标终端利用OCR算法处理银行卡账户信息图像，得到银行卡账户信息，包括PAN、有效期和CVV，可选的，还可获得此卡片关联的手机号码。利用获得的银行卡账户信息，可生成激活虚拟银行卡请求，以便向第一服务器请求激活虚拟银行卡并下载到目标终端中。
526、目标终端向第一服务器发送开卡请求。
目标终端根据第一加密数据获取银行卡账户信息之后，向第一服务器发送开卡请求，从而在第一终端中添加银行卡，开卡请求包括银行卡账户信息。
示例的，目标终端向第一服务器发送激活请求，激活请求包括银行卡账户信息，还可包含卡片关联手机号。第一服务器验证银行卡信息，向关联手机号发送验证码，并接收到目标终端返回的验证码(此验证码由目标终端接收到后自动填充或要求用户手工输入)，此时，第一服务器可判定卡片信息正确且持卡人验证通过。第一服务器向目标终端发送激活响应。激活响应包含一张虚拟银行卡相关的数据，虚拟银行卡是第一服务器根据激活请求中包含的银行卡账户信息生成的。目标终端接收第一服务器发送的激活响应。激活响应用于目标终端激活银行卡账户信息对应的银行卡。
示例的，目标终端将银行卡账户信息发给第一服务器，第一服务器验证账户信 息并执行基于短信验证码的持卡人验证成功后，向目标终端返回虚拟银行卡Token和虚拟银行卡的密钥(该密钥保存于eSE中，交易时用作标识卡片是否合法)等数据，目标终端在eSE中配置Token和卡片密钥，从而激活待激活虚拟银行卡。或者，持卡人验证可在原终端执行，利用原终端接收验证码并通过点对点无线通信连接发给目标终端(还可以是用户在目标终端上输入原终端接收到的验证码)，目标终端将银行卡账户信息和原终端发送的验证码一并发给第一服务器，并接收第一服务器确认提交的信息正确之后返回Token、密钥等数据，在eSE中配置，从而激活待激活虚拟银行卡。
需要说明的是，传统意义上，Token令牌是一个标识身份的硬件，在本申请实施例中，Token是“象征，代表”的意思，即虚拟银行卡卡号是实体银行卡主账号PAN的代表，用户通过手机提交一张实体银行卡的主卡号和附加信息给第一服务器，第一服务器发送一个实体卡的“代表”给手机，手机将这个代表保存于eSE中，这个代表实际上是虚拟卡的主卡号，是由第一服务器根据实体卡号生成的，并且第一服务器会保存Token号和实体卡号的映射关系；当手机将Token提交给一个PoS机进行消费时，消费请求提交给第一服务器，第一服务器会将其翻译成实体卡号，进而向具体的银行发送扣费请求；可见，手机保存的是Token号而非实体卡号，这就降低了通过手机泄露用户卡号的可能，提高了安全性；交易中手机除了提交Token还提交其他利用eSE保存的卡片密钥给PoS，进一步增强了安全性能；手机中如果保存实体卡号，被窃取后存在被黑客利用进行攻击的可能。
目标终端开卡成功后，执行步骤527和步骤528。
527、目标终端向第一服务器发送第一注销消息。
第一注销消息用于指示第一服务器注销业务凭据。
528、目标终端向第二服务器发送第二注销消息。
第二注销消息用于指示第二服务器注销身份凭据。
目标终端向第一服务器发送注销业务凭据的请求，向第二服务器发送注销身份凭据的请求，以便注销两个凭据，防止重放攻击。
本发明实施例提供的添加银行卡的方法，在原终端中利用受保护的运行环境中的安全存储器保存备份的银行卡数据，并在验证目标终端身份成功后通过点对点无线通信连接将备份的银行卡数据发给目标终端，从而在目标终端上恢复银行卡时无需重复相关验证信息，可最大程度的减少用户输入，进而提升用户体验。
图9为本发明实施例提供的一种添加银行卡的方法流程图，其对图5所述的银行卡数据包括第二加密数据的情况进行细化，其中，假设第一终端为目标终端即尚未开通虚拟银行卡的终端，第二终端为原终端即已经开通数张虚拟银行卡的终端，原终端预先存储第二备份数据，目标终端从原终端获取第二备份数据，如图9所示，该方法具体包括以下步骤：
601、原终端接收第一添加银行卡请求。
具体的可以参考步骤501所述的详细叙述，在此不再赘述。
602、原终端根据第一添加银行卡请求获取迁移数据。
原终端接收到第一添加银行卡请求之后，根据第一添加银行卡请求获取迁移数 据。迁移数据包括原终端已经绑定的一张或多张银行卡的PAN的后四位和BIN。具体的，首先，原终端获取银行卡账户信息图像，然后，根据OCR算法处理银行卡账户信息图像，得到银行卡账户信息，再从银行卡账户信息中提取迁移数据，其中，原终端获取银行卡账户信息图像，以及根据OCR算法处理银行卡账户信息图像，得到银行卡账户信息的具体方法可以参考步骤502所述，本申请实施例在此不再赘述。
603、原终端利用原终端的公钥加密迁移数据，得到第二备份数据。
原终端根据第一添加银行卡请求获取到迁移数据之后，利用原终端的公钥加密迁移数据，得到第二备份数据。第二备份数据为经过原终端的公钥加密的迁移数据。
604、原终端将第二备份数据保存于TEE中。
原终端利用原终端的公钥加密迁移数据，得到第二备份数据之后，将第二备份数据保存于TEE中。
605、原终端向第一服务器发送缓存请求。
原终端将第二备份数据保存于TEE中之后，向第一服务器发送缓存请求。缓存请求包括银行卡的PAN的后四位和原终端的终端证书。缓存请求用于请求第一服务器将与PAN后四位相关的银行卡终端账户信息与原终端证书关联。第一服务器预先存储有与PAN后四位相关的银行卡账户信息。
进一步的，第一服务器还可以利用访问密码PIN1与银行卡账户信息关联，将PIN1发送给原终端，原终端将PIN1利用原终端的公钥加密后保存于原终端的TEE中，原终端再设置一个PIN2或指纹来控制对PIN1的访问。即可以通过至少一个密码限制对第一服务器缓存的银行账户信息进行保护。
606、第一服务器接收到缓存请求后，将与PAN后四位相关的银行卡账户信息和原终端证书关联。
将与PAN后四位相关的银行卡账户信息和原终端证书关联，即保存二者的映射关系。
第一服务器接收到原终端发送的缓存请求后，根据PAN后四位获取相关的银行卡账户信息，将银行卡账户信息与原终端证书以及PIN1关联。步骤601-606为原终端向第一服务器发送请求，在服务器端保存银行卡账号相关数据的过程，一般地，在向原终端中添加银行卡时执行。
步骤607至步骤621同图6所示的步骤507至521，本申请实施例在此不再赘述。
622、原终端在TEE中对第二备份数据进行解密，得到迁移数据。
原终端利用原终端的私钥解密第二备份数据，得到迁移数据，即PAN号后四位和BIN。原终端还利用原终端的私钥对迁移数据进行签名。
623、原终端生成第二加密数据。
原终端对第二备份数据进行解密，得到迁移数据之后，生成第二加密数据。原终端通过目标终端证书的公钥对迁移数据和原终端对迁移数据的签名加密，并利用原终端的私钥对通过目标终端的公钥加密的迁移数据进行签名，得到第二加密数据。目标终端的公钥可以从目标终端证书中获取，目标终端证书包括目标终端的公钥。原终端在TEE中存储有原终端的私钥，此私钥与原终端证书中的公钥对应，是一对 非对称密钥。
624、原终端向目标终端发送第二加密数据。
原终端生成第二加密数据之后，通过点对点无线通信连接向目标终端发送第二加密数据。原终端通过点对点无线通信连接向目标终端发送银行卡数据迁移响应，银行卡数据迁移响应是原终端对目标终端发送的银行卡数据迁移请求的应答，银行卡数据迁移响应包括第二加密数据，第二加密数据包括通过原终端的私钥签名和目标终端的公钥加密的迁移数据。
625、原终端向第一服务器发送目标终端证书。
626、第一服务器接收到原终端发送的目标终端证书后，将目标终端证书与银行卡账户信息关联。
这样，当目标终端请求获取备份在第一服务器的银行卡账户信息时，第一服务器可利用原终端提供的目标终端证书检查目标终端的身份，即比对请求获取数据的终端的证书与原终端发送的证书是否一致。需要说明的是，步骤625和步骤626为可选地。
627、目标终端接收到第二加密数据后，解密第二加密数据，得到迁移数据和原终端对迁移数据的签名。
由于第二加密数据由原终端的私钥签名和目标终端的公钥加密，所以，目标终端接收到原终端发送的第二加密数据后，首先，利用原终端证书公钥验证原终端的私钥签名，并利用目标终端的私钥解密第一加密数据，得到迁移数据，即PAN号后四位和BIN，和迁移数据的签名。
628、目标终端向第一服务器发送目标终端证书、迁移数据和原终端对迁移数据的签名。
629、第一服务器接收到第一终端证书、迁移数据和第二终端对迁移数据的签名后，确认目标终端的身份。
第一服务器可以预置签发目标终端证书的CA的根证书，利用根证书验证目标终端证书，确认目标终端是一个合法终端。可选地，第一服务器还可比对原终端发送的目标终端证书，与激活请求中包含的终端证书，两个证书一致且通过根证书验证才认为目标终端合法。
630、第一服务器向目标终端发送银行卡账户信息。
进一步的，获取与迁移数据相关的银行卡账户信息时可要求提供获取密码，获取密码可以由原终端提供，也可以由目标终端的界面获得。
631、第一终端接收到银行卡账户信息后，向第一服务器发送开卡请求。
目标终端获得与迁移数据相关的银行卡账户信息后，可利用银行卡账户信息和用户预留在银行的手机号生成开通虚拟卡请求并提交给第一服务器，第一服务器返回短信验证码到预留手机号，目标终端获取短信验证码，提交给第一服务器，第一服务器验证正确则判定持卡人验证通过，向目标终端返回虚拟银行卡数据即token和虚拟银行卡的密钥，在目标终端上生成银行卡；并将银行卡状态调整为正常。具体的可以参考步骤526所述的详细叙述，在此不再赘述。
目标终端开卡成功后，执行步骤632和步骤633。
632、目标终端向第一服务器发送第一注销消息。
第一注销消息用于指示第一服务器注销业务凭据。
633、目标终端向第二服务器发送第二注销消息。
第二注销消息用于指示第二服务器注销身份凭据。
目标终端向第一服务器发送注销业务凭据的请求，向第二服务器发送注销身份凭据的请求，以便注销两个凭据，防止重放攻击。
本发明实施例提供的添加银行卡的方法，在原终端中利用受保护的运行环境中的安全存储器保存备份的银行卡数据，并在验证目标终端身份成功后通过点对点无线通信连接将备份的银行卡数据发给目标终端，从而在目标终端上恢复银行卡时无需重复相关验证信息，可最大程度的减少用户输入，进而提升用户体验。
图10为本发明实施例提供的一种添加银行卡的方法的流程图，其与以上所述的实施例区别点在于在第一服务器设置一个获取银行卡数据的获取凭据并将之保存于第二终端，当第一终端利用此获取凭据进行获取银行卡数据，用户只需进行简单认证即可快速的恢复设备卡，其中，假设第一终端为目标终端即尚未开通虚拟银行卡的终端，第二终端为原终端即已经开通数张虚拟银行卡的终端，如图10所示，该方法具体包括以下步骤：
701、原终端获取银行卡数据。
原终端成功添加银行卡后，接收备忘数据请求，弹出用户身份验证界面；验证原终端当前用户是否为支付应用的合法用户；验证成功后，通过UI界面提示用户选择要迁移的虚拟银行卡。
702、原终端向第一服务器发送备份请求。
原终端确定选中的银行卡，向第一服务器发送备份请求，备份请求包括银行卡对应的Token、Token有效期、银行卡密钥加密的数据，例如，TSP提供的挑战值或原终端生成的备份卡生成请求。还可利用原终端的私钥签名上述数据。
703、第一服务器接收到备份请求后，验证Token及密钥加密的数据，确认是一个合法的银行卡产生的备份请求。
704、第一服务器生成对应于原终端提交的Token的备份Token以及备份Token的获取凭据。
获取凭据利用原终端的公钥加密。
705、第一服务器向原终端发送备份响应。
备份响应包括备份Token的获取凭据。
706、原终端接收到备份响应后，将获取凭据保存于原终端的TEE或eSE中。
备份Token和原终端提供的Token由同一个PAN产生的，利用备份Token获取凭据可从服务器获取到备份Token。
707、目标终端建立与原终端的点对点无线通信连接。
目标终端可以通过BT、NFC或Wi-Fi P2P建立与原终端的点对点无线通信连接。特别的，此时目标终端和原终端都登录了支付应用的同一个账号。
708、目标终端通过点对点无线通信连接向原终端发送身份凭据。
身份凭据可以是目标终端的证书。
709、原终端接收到目标终端发送的身份凭据后，验证身份凭据。
原终端可预置CA根证书，以便验证目标终端证书；可选的，原终端可以利用原终端TEE证书链中的根证书验证目标终端的证书；验证通过则确认目标终端是一个合法终端。可选的，原终端将确认合法的终端的证书发送到第一服务器。
710、原终端生成加密数据。
原终端利用目标终端证书公钥加密所有的备份Token获取凭据和银行卡缩略图，并发给目标终端。可选地，原终端可将目标终端的证书发给第一服务器。
711、原终端通过点对点无线通信连接向目标终端发送加密数据。
712、目标终端接收到原终端发送的加密数据后，目标终端根据银行卡缩略图在卡包界面中显示全部待激活的银行卡，每一个银行卡都关联一个备份Token获取凭据。
713、目标终端接收用户的激活选择，向第一服务器提交至少一个备份Token获取凭据和目标终端证书。
第一服务器利用预置的CA根证书验证目标终端证书，可选的，第一服务器比较原终端发送的目标终端证书，与目标终端提供的证书，如一致且通过了CA根证书的验证才确认为一个合法终端；此后，向目标终端发送备份Token及相关密钥，目标终端接收到备份Token和相关密钥之后，保存到eSE中。最后，目标终端修改收到了备份Token的银行卡的状态为激活状态。
上述主要从各个网元之间交互的角度对本发明实施例提供的方案进行了介绍。可以理解的是，各个网元，例如第一终端和第二终端为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
本发明实施例可以根据上述方法示例对第一终端和第二终端进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本发明实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用对应各个功能划分各个功能模块的情况下，图11示出了上述和实施例中涉及的第一终端的一种可能的组成示意图，如图11所示，该第一终端80可以包括：连接单元801、接收单元802、处理单元803和发送单元804。
其中，连接单元801，用于支持第一终端执行图5所示的添加银行卡的方法中的步骤402，图7所示的添加银行卡的方法中的步骤518，图9所示的添加银行卡的方法中的步骤618，图10所示的添加银行卡的方法中的步骤707。
接收单元802，用于支持第一终端执行图5所示的添加银行卡的方法中的步骤401、406，图7所示的添加银行卡的方法中的步骤507、513、517、525，图9所 示的添加银行卡的方法中的步骤607、613、617、627，图10所示的添加银行卡的方法中的步骤712。
处理单元803，用于支持第一终端执行图5所示的添加银行卡的方法中的步骤407，图7所示的添加银行卡的方法中的步骤519、525，图9所示的添加银行卡的方法中的步骤619、627。
发送单元804，用于支持第一终端执行图5所示的添加银行卡的方法中的步骤403、408，图7所示的添加银行卡的方法中的步骤508、514、526、527、528，图9所示的添加银行卡的方法中的步骤608、614、628、631、632、633，图9所示的添加银行卡的方法中的步骤713。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
本发明实施例提供的第一终端，用于执行上述添加银行卡的方法，因此可以达到与上述添加银行卡的方法相同的效果。
在采用集成的单元的情况下，图12示出了上述实施例中所涉及的第一终端的另一种可能的组成示意图。如图12所示，该第一终端90包括：处理模块901和通信模块902。
处理模块901用于对第一终端的动作进行控制管理，例如，处理模块901用于支持第一终端执行图5所示的终端中的步骤407，图7所示的添加银行卡的方法中的步骤519，图9所示的添加银行卡的方法中的步骤619，和/或用于本文所描述的技术的其它过程。通信模块902用于支持第一终端与其他网络实体的通信，例如与图5、图7、图9、图10中示出的第一服务器和第二服务器之间的通信。第一终端还可以包括存储模块903，用于存储第一终端的程序代码和数据。
其中，处理模块901可以是处理器或控制器。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信模块902可以是收发器、收发电路或通信接口等。存储模块903可以是存储器。
当处理模块901为处理器，通信模块902为通信接口，存储模块903为存储器时，本发明实施例所涉及的第一终端可以为图4所示的终端。
在采用对应各个功能划分各个功能模块的情况下，图13示出了上述和实施例中涉及的第二终端的一种可能的组成示意图，如图13所示，该第二终端100可以包括：连接单元1001、接收单元1002、处理单元1003和发送单元1004。
其中，连接单元1001，用于支持第一终端执行图5所示的添加银行卡的方法中的步骤402，图7所示的添加银行卡的方法中的步骤518，图9所示的添加银行卡的方法中的步骤618，图10所示的添加银行卡的方法中的步骤707。
接收单元1002，用于支持第二终端执行图5所示的添加银行卡的方法中的步骤404，图7所示的添加银行卡的方法中的步骤501、521，图9所示的添加银行卡的方法中的步骤601、621，图10所示的添加银行卡的方法中的步骤706。
处理单元1003，用于支持第二终端执行图7所示的添加银行卡的方法中的步骤502至506、522、523，图9所示的添加银行卡的方法中的步骤602至604、621、 622、623，图10所示的添加银行卡的方法中的步骤709、710。
发送单元1004，用于支持第二终端执行图5所示的添加银行卡的方法中的步骤405，图7所示的添加银行卡的方法中的步骤524，图9所示的添加银行卡的方法中的步骤605、624、625，图10所示的添加银行卡的方法中的步骤702、711。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
本发明实施例提供的第二终端，用于执行上述添加银行卡的方法，因此可以达到与上述添加银行卡的方法相同的效果。
在采用集成的单元的情况下，图14示出了上述实施例中所涉及的第二终端的另一种可能的组成示意图。如图14所示，该第二终端110包括：处理模块1101和通信模块1102。
处理模块1101用于对第二终端的动作进行控制管理。通信模块1102用于支持第二终端与其他网络实体的通信，例如与图5、图7、图9、图10中示出的第一服务器和第二服务器之间的通信。第二终端还可以包括存储模块1103，用于存储第二终端的程序代码和数据。
其中，处理模块1101可以是处理器或控制器。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信模块1102可以是收发器、收发电路或通信接口等。存储模块1103可以是存储器。
当处理模块1101为处理器，通信模块1102为收发器，存储模块1103为存储器时，本发明实施例所涉及的第二终端可以为图4所示的终端。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个装置，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是一个物理单元或多个物理单元，即可以位于一个地方，或者也可以分布到多个不同地方。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个可读取存储介质中。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该软件产品存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何在本发明揭露的技术范围内的变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。

Claims (19)

  1. 一种添加银行卡的方法，其特征在于，应用于具有受保护的运行环境的第一终端中，包括：
    所述第一终端接收添加银行卡的请求；
    所述第一终端建立与第二终端的点对点无线通信连接；
    所述第一终端向所述第二终端发送获取银行卡数据的请求；
    所述第一终端接收所述第二终端发送的所述银行卡数据；
    所述第一终端根据所述银行卡数据获取银行卡账户信息；
    所述第一终端向第一服务器发送开卡请求，从而在所述第一终端中添加银行卡，所述开卡请求包括所述银行卡账户信息。
  2. 根据权利要求1所述的方法，其特征在于，在所述第一终端接收添加银行卡的请求之后，在所述第一终端建立与第二终端的点对点无线通信连接之前，所述方法还包括：
    在所述第一终端的显示屏幕上至少显示第一选项和第二选项，其中，所述第一选项为输入银行卡号或扫描银行卡或贴卡读号，所述第二选项为从其他终端获取所述银行卡数据。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    在所述第二选项下方显示至少一个所述其他终端的标识；
    或，在所述第一终端接收了所述用户对所述第二选项的选择后，显示至少一个所述其他终端的标识；
    其中，所述其他终端包括所述第二终端，所述其他终端与所述第一终端使用同一账号登陆。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述第一终端向所述第二终端发送获取银行卡数据的请求，具体包括：
    所述第一终端通过所述点对点无线通信连接向所述第二终端发送验证凭据和/或第一终端证书；
    其中，所述验证凭据包含业务凭据和身份凭据，所述第一终端证书是预置在所述第一终端的受保护的运行环境中的终端证书，所述业务凭据用于证明所述第一终端获取银行卡数据的业务合法，所述身份凭据用于证明所述第一终端中登陆的账号合法。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述第一终端接收所述第二终端发送的所述银行卡数据，具体包括：
    所述第一终端接收所述第二终端发送的第一加密数据，其中，所述第一加密数据包括通过所述第二终端的私钥签名和所述第一终端的公钥加密的第一加密银行卡数据、图像处理算法的标识和所述图像处理算法使用的参数，所述第一加密银行卡数据包括银行卡账户信息图像，所述银行卡账户信息图像包括所述银行卡账户信息，所述银行卡账户信息用于标识所述银行卡；
    或，所述第一终端接收所述第二终端发送的第二加密数据，其中，所述第二加密数据包括通过所述第二终端的私钥签名和所述第一终端的公钥加密的迁移数据，所述迁移数据包括主账号PAN后四位和银行标识代码BIN。
  6. 根据权利要求5所述的方法，其特征在于，所述受保护的运行环境是可信执行环境TEE，所述第一终端根据所述银行卡数据获取银行卡账户信息，具体包括：
    所述第一终端在所述TEE中利用所述第二终端的公钥验证所述第二终端的私钥签名，并利用所述第一终端的私钥解密所述第一加密数据，得到所述第一加密银行卡数据、所述图像处理算法的标识和所述图像处理算法使用的参数；
    所述第一终端在所述TEE中根据与所述图像处理算法的标识对应的所述图像处理算法和所述图像处理算法使用的参数，解密所述第一加密银行卡数据，得到所述银行卡账户信息图像；
    所述第一终端在所述TEE中利用光学字符识别OCR算法处理所述银行卡账户信息图像，得到所述银行卡账户信息。
  7. 根据权利要求5所述的方法，其特征在于，所述受保护的运行环境是可信执行环境TEE，所述第一终端根据所述银行卡数据获取银行卡账户信息，具体包括：
    所述第一终端在所述TEE中利用所述第二终端的公钥验证所述第二终端的私钥签名，并利用所述第一终端的私钥解密所述第二加密数据，得到所述迁移数据；
    所述第一终端向所述第一服务器发送第一终端证书、所述迁移数据和所述第二终端对所述迁移数据的签名；
    所述第一终端接收所述第一服务器发送的所述银行卡账户信息。
  8. 根据权利要求4-7任一项所述的方法，其特征在于，所述受保护的运行环境是可信执行环境TEE，在所述第一终端接收了所述用户对所述第二选项的选择后，所述方法还包括：
    所述第一终端从所述第一服务器获取业务凭据，所述业务凭据包括业务序号和所述第一服务器对所述业务序号的签名；
    所述第一终端在所述TEE中保存所述业务凭据。
  9. 根据权利要求8所述的方法，其特征在于，所述第一终端从所述第一服务器获取业务凭据之后，所述方法还包括：
    所述第一终端使用与所述第二终端相同的账号向第二服务器发送所述业务序号；
    所述第一终端接收所述第二服务器发送的所述身份凭据，所述身份凭据包括业务序号和所述第二服务器对所述业务序号的签名；
    所述第一终端在所述TEE中保存所述身份凭据。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    所述第一终端向所述第一服务器发送第一注销消息，所述第一注销消息用于指示所述第一服务器注销所述业务凭据；或/和，
    所述第一终端向所述第二服务器发送第二注销消息，所述第二注销消息用于指示所述第二服务器注销所述身份凭据。
  11. 一种添加银行卡的方法，其特征在于，应用于具有受保护的运行环境的第二终端中，包括：
    第二终端建立与第一终端的点对点无线通信连接；
    所述第二终端接收所述第一终端发送的获取银行卡数据的请求；
    所述第二终端向所述第一终端发送所述银行卡数据。
  12. 根据权利要求11所述的方法，其特征在于，所述受保护的运行环境包括可信执行环境TEE和嵌入式安全单元eSE，在所述第二终端建立与第一终端的点对点无线通信连接之前，所述方法还包括：
    所述第二终端接收添加银行卡的请求；
    所述第二终端根据所述添加银行卡的请求获取银行卡账户信息图像；
    所述第二终端根据图像处理算法对所述银行卡账户信息图像进行图像加密处理，得到第一加密银行卡数据；
    所述第二终端利用第二终端的公钥对所述第一加密银行卡数据进行加密，得到第二加密银行卡数据；
    所述第二终端对所述第二加密银行卡数据设置访问密码，得到第一备份数据；
    所述第二终端将所述第一备份数据保存于所述TEE，将所述图像处理算法的标识和所述图像处理算法使用的参数保存于所述eSE。
  13. 根据权利要求11所述的方法，其特征在于，所述受保护的运行环境包括可信执行环境TEE，在所述第二终端建立与第一终端的点对点无线通信连接之前，所述方法还包括：
    所述第二终端接收添加银行卡的请求；
    所述第二终端根据所述添加银行卡的请求获取迁移数据，所述迁移数据包括主账号PAN后四位和银行标识代码BIN；
    所述第二终端根据所述第二终端的公钥加密所述迁移数据，得到第二备份数据；
    所述第二终端将所述第二备份数据保存于所述TEE；
    所述第二终端向第一服务器发送缓存请求，所述缓存请求包括所述PAN后四位和第二终端证书，所述缓存请求用于请求所述第一服务器将与所述PAN后四位相关的银行卡账户信息与所述第二终端证书关联。
  14. 一种第一终端，其特征在于，所述第一终端中具有受保护的运行环境，所述受保护的运行环境是可信执行环境TEE或安全单元SE，包括：
    接收单元，用于接收添加银行卡的请求；
    连接单元，用于建立与第二终端的点对点无线通信连接；
    发送单元，用于向所述第二终端发送获取银行卡数据的请求；
    所述接收单元，还用于接收所述第二终端发送的所述银行卡数据；
    处理单元，用于根据所述银行卡数据获取银行卡账户信息；
    所述发送单元，还用于向第一服务器发送开卡请求，从而在所述第一终端中添加银行卡，所述开卡请求包括所述银行卡账户信息。
  15. 一种第二终端，其特征在于，应用于具有受保护的运行环境的第二终端中，包括：
    连接单元，用于建立与第一终端的点对点无线通信连接；
    接收单元，用于接收所述第一终端发送的获取银行卡数据的请求；
    发送单元，用于向所述第一终端发送所述银行卡数据。
  16. 一种第一终端，其特征在于，包括：至少一个处理器、存储器、至少一个通信接口和通信总线；
    所述至少一个处理器与所述存储器、所述至少一个通信接口通过所述通信总线连接，所述存储器用于存储计算机软件指令，当所述第一终端运行时，所述处理器执行所述存储器存储的所述计算机软件指令，以使所述第一终端执行如权利要求1-10中任一项所述的添加银行卡的方法。
  17. 一种第二终端，其特征在于，包括：至少一个处理器、存储器、至少一个通信接口和通信总线；
    所述至少一个处理器与所述存储器、所述至少一个通信接口通过所述通信总线连接，所述存储器用于存储计算机软件指令，当所述第二终端运行时，所述处理器执行所述存储器存储的所述计算机软件指令，以使所述第二终端执行如权利要求11-13中任一项所述的添加银行卡的方法。
  18. 一种计算机可读存储介质，其特征在于，包括：计算机软件指令；
    当所述计算机软件指令在第一终端设备上运行时，使得所述第一终端设备执行如权利要求1-10中任一项所述的添加银行卡的方法。
  19. 一种计算机可读存储介质，其特征在于，包括：计算机软件指令；
    当所述计算机软件指令在第二终端设备上运行时，使得所述第二终端设备执行如权利要求11-13中任一项所述的添加银行卡的方法。
PCT/CN2017/086689 2017-01-25 2017-05-31 一种添加银行卡的方法及装置 WO2018137302A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
US16/480,865 US11017373B2 (en) 2017-01-25 2017-05-31 Bank card adding method, and apparatus
EP17893991.4A EP3564886A4 (en) 2017-01-25 2017-05-31 METHOD AND DEVICE FOR ADDING A BANK CARD
CN201780009311.6A CN108604345B (zh) 2017-01-25 2017-05-31 一种添加银行卡的方法及装置
US17/236,473 US11748737B2 (en) 2017-01-25 2021-04-21 Bank card adding method, and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710061359 2017-01-25
CN201710061359.3 2017-01-25

Related Child Applications (2)

Application Number Title Priority Date Filing Date
US16/480,865 A-371-Of-International US11017373B2 (en) 2017-01-25 2017-05-31 Bank card adding method, and apparatus
US17/236,473 Continuation US11748737B2 (en) 2017-01-25 2021-04-21 Bank card adding method, and apparatus

Publications (1)

Publication Number Publication Date
WO2018137302A1 true WO2018137302A1 (zh) 2018-08-02

Family

ID=62977908

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/086689 WO2018137302A1 (zh) 2017-01-25 2017-05-31 一种添加银行卡的方法及装置

Country Status (4)

Country Link
US (2) US11017373B2 (zh)
EP (1) EP3564886A4 (zh)
CN (1) CN108604345B (zh)
WO (1) WO2018137302A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021249527A1 (zh) * 2020-06-12 2021-12-16 支付宝(杭州)信息技术有限公司 实现MOTOpay的方法、装置及电子设备

Families Citing this family (31)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11580531B2 (en) * 2017-08-25 2023-02-14 Mastercard International Incorporated Systems and methods for minimizing user interactions for cardholder authentication
US11010233B1 (en) 2018-01-18 2021-05-18 Pure Storage, Inc Hardware-based system monitoring
KR102442063B1 (ko) * 2018-01-19 2022-09-13 삼성전자주식회사 데이터 통신을 제어하는 방법 및 전자 장치
KR102005549B1 (ko) * 2018-08-09 2019-07-30 주식회사 센스톤 가상코드 기반의 금융거래제공시스템, 가상코드생성장치, 가상코드검증장치, 가상코드 기반의 금융거래제공방법 및 가상코드 기반의 금융거래제공프로그램
US10438437B1 (en) * 2019-03-20 2019-10-08 Capital One Services, Llc Tap to copy data to clipboard via NFC
US11687418B2 (en) 2019-11-22 2023-06-27 Pure Storage, Inc. Automatic generation of recovery plans specific to individual storage elements
US11941116B2 (en) 2019-11-22 2024-03-26 Pure Storage, Inc. Ransomware-based data protection parameter modification
US11341236B2 (en) 2019-11-22 2022-05-24 Pure Storage, Inc. Traffic-based detection of a security threat to a storage system
US11675898B2 (en) 2019-11-22 2023-06-13 Pure Storage, Inc. Recovery dataset management for security threat monitoring
US20210382992A1 (en) * 2019-11-22 2021-12-09 Pure Storage, Inc. Remote Analysis of Potentially Corrupt Data Written to a Storage System
US11500788B2 (en) 2019-11-22 2022-11-15 Pure Storage, Inc. Logical address based authorization of operations with respect to a storage system
US11755751B2 (en) 2019-11-22 2023-09-12 Pure Storage, Inc. Modify access restrictions in response to a possible attack against data stored by a storage system
US11615185B2 (en) 2019-11-22 2023-03-28 Pure Storage, Inc. Multi-layer security threat detection for a storage system
US11657155B2 (en) 2019-11-22 2023-05-23 Pure Storage, Inc Snapshot delta metric based determination of a possible ransomware attack against data maintained by a storage system
US11651075B2 (en) 2019-11-22 2023-05-16 Pure Storage, Inc. Extensible attack monitoring by a storage system
US11645162B2 (en) 2019-11-22 2023-05-09 Pure Storage, Inc. Recovery point determination for data restoration in a storage system
US11720714B2 (en) 2019-11-22 2023-08-08 Pure Storage, Inc. Inter-I/O relationship based detection of a security threat to a storage system
US11520907B1 (en) * 2019-11-22 2022-12-06 Pure Storage, Inc. Storage system snapshot retention based on encrypted data
US11720692B2 (en) 2019-11-22 2023-08-08 Pure Storage, Inc. Hardware token based management of recovery datasets for a storage system
US11625481B2 (en) 2019-11-22 2023-04-11 Pure Storage, Inc. Selective throttling of operations potentially related to a security threat to a storage system
CN111159687B (zh) * 2019-12-31 2022-07-08 维沃移动通信有限公司 账户信息处理方法、电子设备及服务器
CN111666560A (zh) * 2020-05-28 2020-09-15 南开大学 一种基于可信执行环境的密码管理方法和系统
EP4186205A4 (en) * 2020-07-23 2024-01-24 Visa Int Service Ass OFFLINE INTERACTION SYSTEM AND METHOD
CN112581123B (zh) * 2020-12-08 2024-02-23 中国银联股份有限公司 卡管理方法、用户终端、服务器、系统及存储介质
CN112232805B (zh) * 2020-12-15 2021-03-02 中国银联股份有限公司 卡管理方法、用户终端、服务器、系统及存储介质
CN112288425B (zh) * 2020-12-23 2021-04-13 中国银联股份有限公司 支付功能开通方法、终端设备、服务器、系统及存储介质
CN112801655B (zh) * 2021-02-05 2024-02-23 中国银联股份有限公司 支付卡迁移方法、装置、电子设备、服务器和介质
CN113807843B (zh) * 2021-09-06 2023-10-20 中国银联股份有限公司 绑卡方法、用户终端、服务器、系统及存储介质
CN113962691A (zh) * 2021-09-28 2022-01-21 福建省农村信用社联合社 一种无介质银行卡管理方法、系统、设备和介质
CN115033899B (zh) * 2021-11-26 2024-05-14 荣耀终端有限公司 应用数据的迁移方法、终端设备以及存储介质
CN117852565B (zh) * 2024-02-28 2024-05-28 花瓣支付(深圳)有限公司 Nfc卡片生成方法、系统、装置、电子设备及服务器

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104102995A (zh) * 2013-04-12 2014-10-15 联芯科技有限公司 银行卡、移动终端、绑定方法及基于移动终端的支付方法
US20150127539A1 (en) * 2013-11-06 2015-05-07 Tencent Technology (Shenzhen) Company Limited System and method for authenticating, associating and storing secure information
CN105631496A (zh) * 2015-12-30 2016-06-01 深圳中科讯联科技有限公司 远程开卡方法、系统和终端设备
CN106296177A (zh) * 2016-08-30 2017-01-04 中国民生银行股份有限公司 基于银行移动应用的数据处理方法和设备

Family Cites Families (31)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120005039A1 (en) * 2002-02-05 2012-01-05 Jack Dorsey Method of conducting financial transactions
US8566239B2 (en) * 2007-02-22 2013-10-22 First Data Corporation Mobile commerce systems and methods
EP2229970B1 (en) * 2009-03-16 2012-06-06 F. Hoffmann-La Roche AG Bubble trap system for an infusion pump device
US8612352B2 (en) * 2010-10-13 2013-12-17 Square, Inc. Decoding systems with a decoding engine running on a mobile device and coupled to a payment system that includes identifying information of second parties qualified to conduct business with the payment system
US8200260B2 (en) * 2009-08-11 2012-06-12 Ericsson Television, Inc. Systems and methods for processing purchase transactions between mobile phones
US8671055B2 (en) * 2010-03-02 2014-03-11 Digital Life Technologies, Llc Portable E-wallet and universal card
US9619797B2 (en) * 2010-10-13 2017-04-11 Square, Inc. Payment methods with a payment service and tabs selected by a first party and opened by a second party at an geographic location of the first party's mobile device
FR2977187B1 (fr) * 2011-07-01 2017-06-09 Daher Aerospace Procede pour le drapage et la consolidation a la depose de pieces composites thermoplastiques a renfort fibreux
GB2497281A (en) * 2011-12-01 2013-06-12 Barclays Bank Plc Electronic wallet mobile payment transaction system
AU2013221323B2 (en) * 2012-02-15 2018-11-08 Blackhawk Network, Inc System and method of registering stored-value cards into electronic wallets
US8763896B2 (en) * 2012-02-23 2014-07-01 XRomb Inc. System and method of loading a transaction card and processing repayment on a mobile device
CN103312680B (zh) 2012-03-15 2016-10-05 中国移动通信集团公司 一种nfc终端应用的迁移方法、装置及系统
US20130246145A1 (en) * 2012-03-19 2013-09-19 Boku, Inc. Card linking
US11222329B2 (en) * 2012-11-05 2022-01-11 Mastercard International Incorporated Electronic wallet apparatus, method, and computer program product
US9710808B2 (en) * 2013-09-16 2017-07-18 Igor V. SLEPININ Direct digital cash system and method
CN104065639B (zh) 2013-11-06 2015-07-29 腾讯科技（深圳）有限公司 银行卡的绑定方法及系统
US10083484B2 (en) * 2013-11-06 2018-09-25 Visa International Service Association Rotating accounts for transfers
US20150254640A1 (en) * 2014-03-05 2015-09-10 Cryptographi, Inc. Method and apparatus for digital currency paper wallet
CN104918234B (zh) 2014-03-14 2019-01-01 中国移动通信集团公司 一种手机钱包客户端及其应用处理方法及终端设备
US9911116B1 (en) * 2014-05-06 2018-03-06 Square, Inc. Fraud protection in payment card transactions
US9569767B1 (en) * 2014-05-06 2017-02-14 Square, Inc. Fraud protection based on presence indication
US10043185B2 (en) * 2014-05-29 2018-08-07 Apple Inc. User interface for payments
US20150221149A1 (en) * 2014-06-30 2015-08-06 Richard Brewster Main Wifi wallet payments and entry keys
US10318955B2 (en) * 2014-12-23 2019-06-11 Paypal, Inc. Attribute based card combinations for digital wallets
US10438177B2 (en) * 2015-06-15 2019-10-08 Worldpay, Llc System and method for third party payment at point of sale terminals
CN105065639B (zh) 2015-06-19 2019-01-25 北京唐智科技发展有限公司 传动系统共振破裂自动侦察识别与防范监控方法
CN106327188B (zh) 2016-08-15 2020-04-14 华为技术有限公司 支付应用中银行卡的绑定方法及装置
US20180068313A1 (en) * 2016-09-06 2018-03-08 Apple Inc. User interfaces for stored-value accounts
EP3333790A1 (en) * 2016-12-07 2018-06-13 Mastercard International Incorporated Automatic context-based selection from a digital wallet
TW201915864A (zh) * 2017-09-14 2019-04-16 威購金融科技股份有限公司 行動支付系統、行動支付確認裝置及行動支付方法
US11151542B2 (en) * 2019-05-07 2021-10-19 Paypal, Inc. Wearable payment device

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104102995A (zh) * 2013-04-12 2014-10-15 联芯科技有限公司 银行卡、移动终端、绑定方法及基于移动终端的支付方法
US20150127539A1 (en) * 2013-11-06 2015-05-07 Tencent Technology (Shenzhen) Company Limited System and method for authenticating, associating and storing secure information
CN105631496A (zh) * 2015-12-30 2016-06-01 深圳中科讯联科技有限公司 远程开卡方法、系统和终端设备
CN106296177A (zh) * 2016-08-30 2017-01-04 中国民生银行股份有限公司 基于银行移动应用的数据处理方法和设备

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021249527A1 (zh) * 2020-06-12 2021-12-16 支付宝(杭州)信息技术有限公司 实现MOTOpay的方法、装置及电子设备

Also Published As

Publication number Publication date
CN108604345B (zh) 2020-09-25
US11017373B2 (en) 2021-05-25
EP3564886A4 (en) 2020-03-11
US20210264403A1 (en) 2021-08-26
EP3564886A1 (en) 2019-11-06
US11748737B2 (en) 2023-09-05
US20190392417A1 (en) 2019-12-26
CN108604345A (zh) 2018-09-28

Similar Documents

Publication Publication Date Title
WO2018137302A1 (zh) 一种添加银行卡的方法及装置
US11868997B2 (en) Secure payments using a mobile wallet application
EP3926888A1 (en) Data secure backup and secure recovery methods, and electronic device
US10432620B2 (en) Biometric authentication
EP2859488B1 (en) Enterprise triggered 2chk association
JP6117317B2 (ja) 否認防止方法、このための決済管理サーバおよび使用者端末
TWI483204B (zh) 多重用戶電子錢包及其管理
EP2859489B1 (en) Enhanced 2chk authentication security with query transactions
WO2016110101A1 (zh) 一种指纹认证方法、装置、智能终端和计算机存储介质
KR102381153B1 (ko) 신원 정보에 기초한 암호화 키 관리
US11804956B2 (en) Methods and systems for cryptographic keys exchange
US8132244B2 (en) Mobile smartcard based authentication
US20140215589A1 (en) Method for generating a soft token, computer program product and service computer system
US10223690B2 (en) Alternative account identifier
WO2021219086A1 (zh) 基于区块链的数据传输方法和系统
JP2017530586A (ja) クライアントをデバイスに対して認証するシステム及び方法
WO2012055166A1 (zh) 移动存储设备、基于该设备的数据处理系统和方法
US20180285857A1 (en) Mobile payment method using a barcode, device and server for implementing the method
TWI715833B (zh) 一種空中發卡方法、裝置、計算設備、電腦可讀存儲介質及電腦程式產品
KR20230013019A (ko) 모바일 운영 체제에서 응용프로그램 간 통신의 활성화
AU2019204157A1 (en) Method, system and device for e-commerce payment intelligent access control
WO2015168878A1 (zh) 支付方法和装置以及支付要素处理方法和装置
KR101639794B1 (ko) 본인 확인 및 본인 인증을 위한 인증 방법 및 시스템
CA3016643A1 (en) System and method for remote identification during transaction processing
WO2014063546A1 (zh) 处理来自移动终端的数据访问请求的设备和方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17893991

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017893991

Country of ref document: EP

Effective date: 20190802